Windows ImageLoad of Unsigned .node Native Add-on Files
Alerts on Windows loading of unsigned or unverifiable .node files, indicating potential native code execution in Electron-based apps.
- Product
- windows
- Category
- image_load
- Author
- Jonathan Beierle (@hullabrian) (SigmaHQ), DRL 1.1
- Published
- 2025-11-22
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows image loads where the loaded module ends with .node and the signature state indicates an unsigned or unavailable certificate. Unsigned native add-ons can be abused to execute arbitrary code within trusted Electron-based desktop applications. The detection relies on Windows image-load telemetry including the loaded image path/extension and signature fields such as Signed and SignatureStatus. It also suppresses specific optional paths related to Code.exe extensions to reduce noise.
Reporting behind it
- coreycburton.comhttps://www.coreycburton.com/blog/driploader-case-study
- github.comhttps://github.com/CoreyCBurton/DripLoaderNG
- electronjs.orghttps://www.electronjs.org/docs/latest/tutorial/native-code-and-electron
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_unsigned_node_load.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows ImageLoad of Unsigned .node Native Add-on Files
id: 03885d3b-3845-48ef-8bae-ffc41f13b487
status: experimental
description: This rule flags Windows image loads where the loaded module ends with .node and the signature state indicates an unsigned or unavailable certificate. Unsigned native add-ons can be abused to execute arbitrary code within trusted Electron-based desktop applications. The detection relies on Windows image-load telemetry including the loaded image path/extension and signature fields such as Signed and SignatureStatus. It also suppresses specific optional paths related to Code.exe extensions to reduce noise.
references:
- https://www.coreycburton.com/blog/driploader-case-study
- https://github.com/CoreyCBurton/DripLoaderNG
- https://www.electronjs.org/docs/latest/tutorial/native-code-and-electron
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_unsigned_node_load.yml
author: Jonathan Beierle (@hullabrian), Huntrule Team
date: 2025-11-22
tags:
- attack.execution
- attack.privilege-escalation
- attack.persistence
- attack.stealth
- attack.t1129
- attack.t1574.001
- attack.t1036.005
logsource:
category: image_load
product: windows
detection:
selection_node_extension:
ImageLoaded|endswith: .node
selection_status:
- Signed: "false"
- SignatureStatus: Unavailable
filter_optional_vscode_jupyter:
Image|endswith: \Code.exe
ImageLoaded|contains: .vscode\extensions\ms-toolsai.jupyter-
ImageLoaded|endswith:
- \electron.napi.node
- \node.napi.glibc.node
condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
- VsCode extensions or similar legitimate tools might use unsigned .node files. These should be investigated on a case-by-case basis, and whitelisted if determined to be benign.
level: medium
license: DRL-1.1
related:
- id: e5f5c693-52d7-4de5-88ae-afbfbce85595
type: derived