Windows Process Creation: node.exe Running npx skills add New Agent Skills

Alerts when node.exe invokes the npx skills add flow to install new agent skills on Windows.

FreeUnreviewedSigmamediumv1

windows-process-creation-node-exe-running-npx-skills-add-new-agent-skills-afa71271

title: "Windows Process Creation: node.exe Running npx skills add New Agent Skills"
id: 1ff449fb-4bdf-4546-86c9-c109602ede1d
status: experimental
description: This rule flags Windows process executions where node.exe is used to run an npx CLI script with arguments that add agent skills (including command line patterns containing "npx-cli.js", "skills ", and " add "). Attackers may abuse agent skill installation workflows to introduce malicious capabilities that execute on behalf of the user. Detection relies on process creation telemetry capturing the executed image and full command line for the node.exe process.
references:
  - https://blog.lukaszolejnik.com/supply-chain-risk-of-agentic-ai-infecting-infrastructures-via-skill-worms/
  - https://github.com/vercel-labs/skills/blob/1f7fbc8d0e49c4e0601d364696bd1bdd15e80967/README.md
  - https://opensourcemalware.com/blog/clawdbot-skills-ganked-your-crypto
  - https://promptintel.novahunting.ai/molt
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_node_new_agent_skills_installed.yml
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule Team
date: 2026-02-03
tags:
  - attack.execution
  - attack.t1059.007
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \node.exe
    - OriginalFileName: node.exe
  selection_cli:
    CommandLine|contains|all:
      - npx-cli.js
      - "skills "
      - " add "
  condition: all of selection_*
falsepositives:
  - This rule will be triggered when a new agent skill is installed regardless if it is benign or malicious.
  - High false positive rate expected in environments where AI agent tooling is authorized and commonly used.
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_node_new_agent_skills_installed/info.yml
license: DRL-1.1
related:
  - id: afa71271-6a97-4e47-810f-83120fb1a4ce
    type: derived

What it detects

This rule flags Windows process executions where node.exe is used to run an npx CLI script with arguments that add agent skills (including command line patterns containing "npx-cli.js", "skills ", and " add "). Attackers may abuse agent skill installation workflows to introduce malicious capabilities that execute on behalf of the user. Detection relies on process creation telemetry capturing the executed image and full command line for the node.exe process.

Known false positives

This rule will be triggered when a new agent skill is installed regardless if it is benign or malicious.
High false positive rate expected in environments where AI agent tooling is authorized and commonly used.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.