Windows Process Execution of JavaScript via Node.exe

Alerts when node.exe starts a process with a .js argument on Windows, which may indicate suspicious script execution.

FreeReviewedSigma · Low · v1

Product: windows
Category: process_creation
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2025-04-21
Updated: 2026-07-30

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059.007JavaScript
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process executions where a node.exe binary associated with Node.js is launched with a command line containing a .js argument. Running JavaScript from Node.js is common in development, but it can also be used to execute attacker-supplied scripts disguised as legitimate activity. The detection relies on process creation telemetry, including the process image filename and command-line content. It may produce false positives in environments where Node.js script execution is expected.

Reporting behind it

Related detections9 linkedT1059.007 — drag to rearrange

Suspicious npm Postinstall Node Execution From Fixtures Path (BeaverTail OtterCookie)

Suspicious Script Host Execution of Decoy-Named JavaScript Dropper (PS1Bot)

Malicious Emmenhtal JavaScript Loader Spawning Encoded PowerShell

Suspicious Script Host Spawning PowerShell With Bypass And Hidden Execution

Possible React2Shell CVE-2025-55182 Prototype Pollution Exploitation

Suspicious Node.js Script Execution from AppData Roaming

Possible Reflected XSS via cPanel cpanelwebcall Endpoint CVE-2023-29489

SocGholish Fake Browser Update Script Execution (via process_creation)

Suspicious Contagious Interview Disk Enumeration via Node Spawning Wmic

Windows Process Execution of JavaScript via Node.exe

Pivot detection · T1059.007 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-execution-of-javascript-via-node-exe-ba3874b9

title: Windows Process Execution of JavaScript via Node.exe
id: e0ca41c4-85ea-4d14-8f7e-b770e2cbd76e
status: experimental
description: This rule flags Windows process executions where a node.exe binary associated with Node.js is launched with a command line containing a .js argument. Running JavaScript from Node.js is common in development, but it can also be used to execute attacker-supplied scripts disguised as legitimate activity. The detection relies on process creation telemetry, including the process image filename and command-line content. It may produce false positives in environments where Node.js script execution is expected.
references:
  - https://www.microsoft.com/en-us/security/blog/2025/04/15/threat-actors-misuse-node-js-to-deliver-malware-and-other-malicious-payloads/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_security_susp_node_js_execution.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-04-21
tags:
  - attack.execution
  - attack.t1059.007
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \node.exe
    - OriginalFileName: node.exe
    - Product: Node.js
  selection_cmd:
    CommandLine|contains: .js
  condition: all of selection_*
falsepositives:
  - Legitimate use of node.exe to execute JavaScript or JSC files on your environment
level: low
license: DRL-1.1
related:
  - id: ba3874b9-0fae-465f-836c-eb5d071a1789
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL