Windows File Creation Indicators Linked to Malicious Axios npm Supply-Chain Components

Flags Windows file creation of wt.exe/system.bat and temp .vbs/.ps1 payloads when created by node.exe or powershell.exe.

FreeReviewedSigma · High · v5

Product: windows
Category: file_event
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2026-04-01
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Initial Access

Recon
Resource Dev
Initial Access
- T1195.002Compromise Software Supply Chain
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows file creation activity consistent with a malicious payload dropping and staging artifacts under common user and system paths. It matches process image endings for node.exe and powershell.exe and specific target filenames used for executables and scripts in ProgramData and AppData\Local\Temp. This behavior matters because supply-chain compromises often rely on postinstall execution to place RAT/dropper components and supporting scripts, and this rule relies on Windows file event telemetry with target filename paths and originating process image names.

Reporting behind it

Related detections9 linkedT1195.002 — drag to rearrange

Suspicious Child Process Spawned by Python Interpreter via Process Creation

Suspicious npm Postinstall Node Execution From Fixtures Path (BeaverTail OtterCookie)

Suspicious TrueConf Update Chain Spawning Temporary Executable in Operation TrueChaos

Malicious TeamPCP durabletask Payload python3 managed.pyz from tmp (via process_creation)

Malicious PowerShell Download from bullethost.cloud Staging Server

Suspicious NPM Install Hook Executing Setup Script via Node

Suspicious Shai-Hulud Worm Stager Execution from Temp (via process_creation)

Suspicious Double Base64 Decoded Payload Piped to Shell in CI (reviewdog Supply Chain)

Suspicious Node.js Spawning PowerShell Archive Download to Temp

Windows File Creation Indicators Linked to Malicious Axios npm Supply-Chain Components

Pivot detection · T1195.002 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-file-creation-indicators-for-axios-npm-compromise-drops-node-exe-powersh-cd6386fa

title: Windows File Creation Indicators Linked to Malicious Axios npm Supply-Chain Components
id: c6f0371e-c83b-4e7e-989b-9f3d2c996fe7
status: experimental
description: This rule identifies Windows file creation activity consistent with a malicious payload dropping and staging artifacts under common user and system paths. It matches process image endings for node.exe and powershell.exe and specific target filenames used for executables and scripts in ProgramData and AppData\Local\Temp. This behavior matters because supply-chain compromises often rely on postinstall execution to place RAT/dropper components and supporting scripts, and this rule relies on Windows file event telemetry with target filename paths and originating process image names.
references:
  - https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
  - https://www.derp.ca/research/axios-npm-supply-chain-rat/
  - https://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html
  - https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections
  - https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/Axios-NPM-Compromise/file_event_win_axios_npm_compromise_indicators.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-04-01
tags:
  - attack.initial-access
  - attack.t1195.002
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection_img:
    Image|endswith:
      - \node.exe
      - \powershell.exe
  selection_fils:
    - TargetFilename:
        - C:\ProgramData\wt.exe
        - C:\ProgramData\system.bat
    - TargetFilename|contains|all:
        - C:\Users\
        - \AppData\Local\Temp\6202033.vbs
    - TargetFilename|contains|all:
        - C:\Users\
        - \AppData\Local\Temp\6202033.ps1
  condition: all of selection_*
falsepositives:
  - Highly unlikely
level: high
license: DRL-1.1
related:
  - id: cd6386fa-bb9a-4b67-b006-786b6ab5d2ba
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL