Windows process chain for Axios npm compromise: cscript vbs temp deletion, curl C2, PowerShell hidden payload

title: "Windows process chain for Axios npm compromise: cscript vbs temp deletion, curl C2, PowerShell hidden payload"
id: fb09f27e-400d-48e8-8487-b8f44392511a
status: experimental
description: This rule flags a specific Windows execution chain tied to the Axios npm supply-chain compromise, including a VBScript run from a Temp path that deletes a staged script file. It also detects process activity consistent with fetching C2 content over HTTP from a hard-coded domain and launching a hidden PowerShell payload via a masqueraded Windows Terminal execution path. The detection relies on process creation telemetry with parent/child image paths and command-line substrings to match the observed process tree.
references:
  - https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
  - https://thehackernews.com/2026/03/axios-supply-chain-attack-pushes-cross.html?m=1
  - https://www.derp.ca/research/axios-npm-supply-chain-rat/
  - https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections
  - https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/Axios-NPM-Compromise/proc_creation_win_axios_npm_compromise_indicators.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-04-01
tags:
  - attack.initial-access
  - attack.t1195.002
  - attack.execution
  - attack.command-and-control
  - attack.t1059.003
  - attack.t1059.005
  - attack.t1105
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_cscript:
    ParentImage|endswith:
      - \node.exe
      - \bun.exe
    Image|endswith: \cmd.exe
    CommandLine|contains|all:
      - cscript
      - AppData\Local\Temp
      - //nologo && del
      - 6202033.vbs
  selection_curl:
    Image|endswith:
      - \curl.exe
      - \powershell.exe
    CommandLine|contains: http://sfrclak.com
  selection_susp_cli:
    OriginalFileName: PowerShell.EXE
    CommandLine|contains: '"C:\ProgramData\wt.exe" -w hidden -ep bypass -file'
  condition: 1 of selection_*
falsepositives:
  - Highly unlikely
level: high
license: DRL-1.1
related:
  - id: f6c27ecc-d890-4452-80e6-2e274a10e097
    type: derived