Windows Process Tree for Axios npm Supply-Chain RAT Droppers (cscript, curl, PowerShell)

Alerts on the Windows process/command-line pattern consistent with the Axios npm compromise execution and C2 fetch.

FreeReviewedSigma · High · v5

Product: windows
Category: process_creation
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2026-04-01
Updated: 2026-07-31

ATT&CK techniques

Initial Access → C2

Recon
Resource Dev
Initial Access
- T1195.002Compromise Software Supply Chain
Execution
- T1059.003Windows Command Shell
- T1059.005Visual Basic
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1105Ingress Tool Transfer
Exfiltration
Impact

What it detects

This rule identifies a specific Windows execution chain tied to the Axios npm supply-chain compromise, where a process tree uses cscript/vbs in a Temp-driven execution flow, followed by network contact via curl and a PowerShell invocation masquerading as Windows Terminal. Attackers leverage this staged chain to run a malicious postinstall payload, fetch platform-specific RAT components from attacker infrastructure, and remove evidence by deleting the script and modifying package artifacts. Detection relies on Windows process creation telemetry, including parent/child image paths and command-line substrings that match the described indicators and C2 URL.

Reporting behind it

Related detections9 linkedT1105 — drag to rearrange

Malicious Kimsuky VBE Payload Download via Curl to AppData and Execution (via process_creation)

Malicious SCMBanker ClickFix Payload Fetch via Curl Piped to Cmd

Suspicious Network Download Spawned by Node.js During Package Install

Suspicious Aimmy Cheat Loader Executing Renamed LuaJIT Launcher via process_creation

Malicious WSH Script Execution from WebDAV Share (via process_creation)

Suspicious Cmd Using Curl to Download and Execute Payload (via process_creation)

Linux process chain for Axios NPM compromise: curl download with nohup and python3

macOS: Axios NPM compromise file creation via curl and node indicators

macOS: Detect Axios malicious npm execution chain using osascript, curl download, and cleanup

Windows Process Tree for Axios npm Supply-Chain RAT Droppers (cscript, curl, PowerShell)

Pivot detection · T1105 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-chain-for-axios-npm-compromise-cscript-vbs-temp-deletion-curl-c2-f6c27ecc

title: Windows Process Tree for Axios npm Supply-Chain RAT Droppers (cscript, curl, PowerShell)
id: fb09f27e-400d-48e8-8487-b8f44392511a
status: experimental
description: This rule identifies a specific Windows execution chain tied to the Axios npm supply-chain compromise, where a process tree uses cscript/vbs in a Temp-driven execution flow, followed by network contact via curl and a PowerShell invocation masquerading as Windows Terminal. Attackers leverage this staged chain to run a malicious postinstall payload, fetch platform-specific RAT components from attacker infrastructure, and remove evidence by deleting the script and modifying package artifacts. Detection relies on Windows process creation telemetry, including parent/child image paths and command-line substrings that match the described indicators and C2 URL.
references:
  - https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
  - https://thehackernews.com/2026/03/axios-supply-chain-attack-pushes-cross.html?m=1
  - https://www.derp.ca/research/axios-npm-supply-chain-rat/
  - https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections
  - https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/Axios-NPM-Compromise/proc_creation_win_axios_npm_compromise_indicators.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-04-01
tags:
  - attack.initial-access
  - attack.t1195.002
  - attack.execution
  - attack.command-and-control
  - attack.t1059.003
  - attack.t1059.005
  - attack.t1105
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_cscript:
    ParentImage|endswith:
      - \node.exe
      - \bun.exe
    Image|endswith: \cmd.exe
    CommandLine|contains|all:
      - cscript
      - AppData\Local\Temp
      - //nologo && del
      - 6202033.vbs
  selection_curl:
    Image|endswith:
      - \curl.exe
      - \powershell.exe
    CommandLine|contains: http://sfrclak.com
  selection_susp_cli:
    OriginalFileName: PowerShell.EXE
    CommandLine|contains: '"C:\ProgramData\wt.exe" -w hidden -ep bypass -file'
  condition: 1 of selection_*
falsepositives:
  - Highly unlikely
level: high
license: DRL-1.1
related:
  - id: f6c27ecc-d890-4452-80e6-2e274a10e097
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL