Windows Process Execution: Microsoft.NodejsTools.PressAnyKey.exe Child Spawns

Flags child processes started by Microsoft.NodejsTools.PressAnyKey.exe, which may be abused to run arbitrary binaries.

FreeUnreviewedSigmamediumv1

windows-process-execution-microsoft-nodejstools-pressanykey-exe-child-spawns-a20391f8

title: "Windows Process Execution: Microsoft.NodejsTools.PressAnyKey.exe Child Spawns"
id: b1fbb7c4-a972-4388-84b2-f800b6766cbc
related:
  - id: 65c3ca2c-525f-4ced-968e-246a713d164f
    type: similar
  - id: a20391f8-76fb-437b-abc0-dba2df1952c6
    type: derived
status: test
description: This rule identifies Windows process creation events where a child process is spawned by Microsoft.NodejsTools.PressAnyKey.exe. Attackers can abuse this parent process to launch arbitrary binaries, helping them execute code under a trusted-looking process context. The detection relies on parent-child relationships in process creation telemetry, matching the parent image suffix.
references:
  - https://twitter.com/mrd0x/status/1463526834918854661
  - https://gist.github.com/nasbench/a989ce64cefa8081bd50cf6ad8c491b5
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pressanykey_lolbin_execution.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-01-11
modified: 2023-04-11
tags:
  - attack.execution
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \Microsoft.NodejsTools.PressAnyKey.exe
  condition: selection
falsepositives:
  - Legitimate use by developers as part of NodeJS development with Visual Studio Tools
level: medium
license: DRL-1.1

What it detects

This rule identifies Windows process creation events where a child process is spawned by Microsoft.NodejsTools.PressAnyKey.exe. Attackers can abuse this parent process to launch arbitrary binaries, helping them execute code under a trusted-looking process context. The detection relies on parent-child relationships in process creation telemetry, matching the parent image suffix.

Known false positives

Legitimate use by developers as part of NodeJS development with Visual Studio Tools

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.