Windows ImageLoad of Unsigned .node Native Add-on Files

title: Windows ImageLoad of Unsigned .node Native Add-on Files
id: 03885d3b-3845-48ef-8bae-ffc41f13b487
status: experimental
description: This rule flags Windows image loads where the loaded module ends with .node and the signature state indicates an unsigned or unavailable certificate. Unsigned native add-ons can be abused to execute arbitrary code within trusted Electron-based desktop applications. The detection relies on Windows image-load telemetry including the loaded image path/extension and signature fields such as Signed and SignatureStatus. It also suppresses specific optional paths related to Code.exe extensions to reduce noise.
references:
  - https://www.coreycburton.com/blog/driploader-case-study
  - https://github.com/CoreyCBurton/DripLoaderNG
  - https://www.electronjs.org/docs/latest/tutorial/native-code-and-electron
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_unsigned_node_load.yml
author: Jonathan Beierle (@hullabrian), Huntrule Team
date: 2025-11-22
tags:
  - attack.execution
  - attack.privilege-escalation
  - attack.persistence
  - attack.stealth
  - attack.t1129
  - attack.t1574.001
  - attack.t1036.005
logsource:
  category: image_load
  product: windows
detection:
  selection_node_extension:
    ImageLoaded|endswith: .node
  selection_status:
    - Signed: "false"
    - SignatureStatus: Unavailable
  filter_optional_vscode_jupyter:
    Image|endswith: \Code.exe
    ImageLoaded|contains: .vscode\extensions\ms-toolsai.jupyter-
    ImageLoaded|endswith:
      - \electron.napi.node
      - \node.napi.glibc.node
  condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
  - VsCode extensions or similar legitimate tools might use unsigned .node files. These should be investigated on a case-by-case basis, and whitelisted if determined to be benign.
level: medium
license: DRL-1.1
related:
  - id: e5f5c693-52d7-4de5-88ae-afbfbce85595
    type: derived