Windows Process Creation: node.exe Running npx skills add New Agent Skills
Alerts when node.exe invokes the npx skills add flow to install new agent skills on Windows.
- Product
- windows
- Category
- process_creation
- Author
- Marco Pedrinazzi (@pedrinazziM) (InTheCyber) (SigmaHQ), DRL 1.1
- Published
- 2026-02-03
- Updated
- 2026-07-30
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process executions where node.exe is used to run an npx CLI script with arguments that add agent skills (including command line patterns containing "npx-cli.js", "skills ", and " add "). Attackers may abuse agent skill installation workflows to introduce malicious capabilities that execute on behalf of the user. Detection relies on process creation telemetry capturing the executed image and full command line for the node.exe process.
Reporting behind it
- blog.lukaszolejnik.comhttps://blog.lukaszolejnik.com/supply-chain-risk-of-agentic-ai-infecting-infrastructures-via-skill-worms/
- github.comhttps://github.com/vercel-labs/skills/blob/1f7fbc8d0e49c4e0601d364696bd1bdd15e80967/README.md
- opensourcemalware.comhttps://opensourcemalware.com/blog/clawdbot-skills-ganked-your-crypto
- promptintel.novahunting.aihttps://promptintel.novahunting.ai/molt
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_node_new_agent_skills_installed.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: node.exe Running npx skills add New Agent Skills"
id: 1ff449fb-4bdf-4546-86c9-c109602ede1d
status: experimental
description: This rule flags Windows process executions where node.exe is used to run an npx CLI script with arguments that add agent skills (including command line patterns containing "npx-cli.js", "skills ", and " add "). Attackers may abuse agent skill installation workflows to introduce malicious capabilities that execute on behalf of the user. Detection relies on process creation telemetry capturing the executed image and full command line for the node.exe process.
references:
- https://blog.lukaszolejnik.com/supply-chain-risk-of-agentic-ai-infecting-infrastructures-via-skill-worms/
- https://github.com/vercel-labs/skills/blob/1f7fbc8d0e49c4e0601d364696bd1bdd15e80967/README.md
- https://opensourcemalware.com/blog/clawdbot-skills-ganked-your-crypto
- https://promptintel.novahunting.ai/molt
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_node_new_agent_skills_installed.yml
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber), Huntrule Team
date: 2026-02-03
tags:
- attack.execution
- attack.t1059.007
logsource:
product: windows
category: process_creation
detection:
selection_img:
- Image|endswith: \node.exe
- OriginalFileName: node.exe
selection_cli:
CommandLine|contains|all:
- npx-cli.js
- "skills "
- " add "
condition: all of selection_*
falsepositives:
- This rule will be triggered when a new agent skill is installed regardless if it is benign or malicious.
- High false positive rate expected in environments where AI agent tooling is authorized and commonly used.
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_node_new_agent_skills_installed/info.yml
license: DRL-1.1
related:
- id: afa71271-6a97-4e47-810f-83120fb1a4ce
type: derived