Windows ImageLoad: Unsigned .node Native Add-on Loaded

title: "Windows ImageLoad: Unsigned .node Native Add-on Loaded"
id: 03885d3b-3845-48ef-8bae-ffc41f13b487
status: experimental
description: This rule flags Windows image loads where the loaded image ends with .node and the signature state is either unsigned or unavailable. Loading unsigned native Node/Electron add-ons can enable arbitrary native code execution within trusted desktop applications. The detection relies on Windows image load telemetry and code signing status fields, with optional exclusions for specific VS Code/Jupyter-related binaries to reduce noise.
references:
  - https://www.coreycburton.com/blog/driploader-case-study
  - https://github.com/CoreyCBurton/DripLoaderNG
  - https://www.electronjs.org/docs/latest/tutorial/native-code-and-electron
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_unsigned_node_load.yml
author: Jonathan Beierle (@hullabrian), Huntrule Team
date: 2025-11-22
tags:
  - attack.execution
  - attack.privilege-escalation
  - attack.persistence
  - attack.stealth
  - attack.t1129
  - attack.t1574.001
  - attack.t1036.005
logsource:
  category: image_load
  product: windows
detection:
  selection_node_extension:
    ImageLoaded|endswith: .node
  selection_status:
    - Signed: "false"
    - SignatureStatus: Unavailable
  filter_optional_vscode_jupyter:
    Image|endswith: \Code.exe
    ImageLoaded|contains: .vscode\extensions\ms-toolsai.jupyter-
    ImageLoaded|endswith:
      - \electron.napi.node
      - \node.napi.glibc.node
  condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
  - VsCode extensions or similar legitimate tools might use unsigned .node files. These should be investigated on a case-by-case basis, and whitelisted if determined to be benign.
level: medium
license: DRL-1.1
related:
  - id: e5f5c693-52d7-4de5-88ae-afbfbce85595
    type: derived