Windows File Creation Indicators Linked to Malicious Axios npm Supply-Chain Components

Flags Windows file creation of wt.exe/system.bat and temp .vbs/.ps1 payloads when created by node.exe or powershell.exe.

FreeReviewedSigma · High · v5

Product: windows
Category: file_event
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2026-04-01
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Initial Access

Recon
Resource Dev
Initial Access
- T1195.002Compromise Software Supply Chain
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows file creation activity consistent with a malicious payload dropping and staging artifacts under common user and system paths. It matches process image endings for node.exe and powershell.exe and specific target filenames used for executables and scripts in ProgramData and AppData\Local\Temp. This behavior matters because supply-chain compromises often rely on postinstall execution to place RAT/dropper components and supporting scripts, and this rule relies on Windows file event telemetry with target filename paths and originating process image names.

Reporting behind it

Related detections9 linkedT1195.002 — drag to rearrange

Malicious Shai-Hulud Self-Hosted GitHub Runner Registration via Process Creation

Suspicious Google Workspace OAuth Authorization for Chrome Web Store Scope via Token Audit

Malicious Shai-Hulud npm Worm Marker via SHA1HULUD Process Name (via process_creation)

Malicious Shai-Hulud Self-Hosted GitHub Actions Runner Named SHA1HULUD (via process_creation)

Suspicious npm Package Spawning cURL Download via Process Creation

Suspicious Child Process Spawned by Notepad++ Updater GUP

Suspicious Execution From Hidden fonts-unix Directory in tmp on Linux

Suspicious Malicious MCP Package devtools-assistant Execution (via process_creation)

Suspicious Bun Runtime Spawned by Node During npm Lifecycle

Windows File Creation Indicators Linked to Malicious Axios npm Supply-Chain Components

Pivot detection · T1195.002 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-file-creation-indicators-for-axios-npm-compromise-drops-node-exe-powersh-cd6386fa

title: Windows File Creation Indicators Linked to Malicious Axios npm Supply-Chain Components
id: c6f0371e-c83b-4e7e-989b-9f3d2c996fe7
status: experimental
description: This rule identifies Windows file creation activity consistent with a malicious payload dropping and staging artifacts under common user and system paths. It matches process image endings for node.exe and powershell.exe and specific target filenames used for executables and scripts in ProgramData and AppData\Local\Temp. This behavior matters because supply-chain compromises often rely on postinstall execution to place RAT/dropper components and supporting scripts, and this rule relies on Windows file event telemetry with target filename paths and originating process image names.
references:
  - https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
  - https://www.derp.ca/research/axios-npm-supply-chain-rat/
  - https://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html
  - https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections
  - https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/Axios-NPM-Compromise/file_event_win_axios_npm_compromise_indicators.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-04-01
tags:
  - attack.initial-access
  - attack.t1195.002
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection_img:
    Image|endswith:
      - \node.exe
      - \powershell.exe
  selection_fils:
    - TargetFilename:
        - C:\ProgramData\wt.exe
        - C:\ProgramData\system.bat
    - TargetFilename|contains|all:
        - C:\Users\
        - \AppData\Local\Temp\6202033.vbs
    - TargetFilename|contains|all:
        - C:\Users\
        - \AppData\Local\Temp\6202033.ps1
  condition: all of selection_*
falsepositives:
  - Highly unlikely
level: high
license: DRL-1.1
related:
  - id: cd6386fa-bb9a-4b67-b006-786b6ab5d2ba
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL