Windows Process Creation: Node.js Executions from Adobe Creative Cloud

title: "Windows Process Creation: Node.js Executions from Adobe Creative Cloud"
id: 20e85cbf-26d0-4026-81de-12b9d69ad9e5
status: test
description: This rule identifies when a Windows process is launched using Node.js packaged within the Adobe Creative Cloud installation. Attackers can use bundled runtimes to execute scripts from within legitimate software directories, helping blend execution into normal system activity. The detection relies on process creation telemetry that captures the executable path and command line, specifically matching the Creative Cloud node.exe location while excluding command lines that indicate Adobe Creative Cloud JavaScript resource usage.
references:
  - https://twitter.com/mttaggart/status/1511804863293784064
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_node_adobe_creative_cloud_abuse.yml
author: Max Altgelt (Nextron Systems), Huntrule Team
date: 2022-04-06
tags:
  - attack.execution
  - attack.stealth
  - attack.t1127
  - attack.t1059.007
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \Adobe Creative Cloud Experience\libs\node.exe
  filter:
    CommandLine|contains: Adobe Creative Cloud Experience\js
  condition: selection and not filter
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: df1f26d3-bea7-4700-9ea2-ad3e990cf90e
    type: derived