Coverage › CVE-2024-4978
CVE-2024-4978 Mapped Sigma
Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability
- Vendor / product
- Justice AV Solutions — Viewer
- Description (CISA)
- Justice AV Solutions (JAVS) Viewer installer contains a malicious version of ffmpeg.exe, named fffmpeg.exe (SHA256: 421a4ad2615941b177b6ec4ab5e239c14e62af2ab07c6df1741e2a62223223c4). When run, this creates a backdoor connection to a malicious C2 server.
- Added to KEV
- 2024-05-29
- Due date
- 2024-06-19
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Known ransomware use
- Unknown
- CWE
- CWE-506
- CISA notes
- Please follow the vendor’s instructions as outlined in the public statements at https://www.rapid7.com/blog/post/2024/05/23/cve-2024-4978-backdoored-justice-av-solutions-viewer-software-used-in-apparent-supply-chain-attack#remediation and https://www.javs.com/downloads
https://nvd.nist.gov/vuln/detail/CVE-2024-4978 - Elsewhere
- cve.org · NVD · CISA KEV · JSON
ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28
4 mapping objects across 4 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.
| Technique | Mapping type | CTID comment | Status in v19.2 |
|---|---|---|---|
| T1195.002 Compromise Software Supply Chain | exploitation technique | CVE-2024-4978 is a vulnerability where compromised software is signed and hosted on the legitimate software distribution website. Adversaries have been observed to use this backdoored software to install additional tools on target machines. The adversary-installed software establishing persistent communications with a command-and-control (C2) server using Windows sockets and WinHTTP requests. Once successfully connected, it transmits data about the compromised host, including hostname, operating system details, processor architecture, program working directory and the user name to the C2. ref 1 |
live |
| T1005 Data from Local System | secondary impact | CVE-2024-4978 is a vulnerability where compromised software is signed and hosted on the legitimate software distribution website. Adversaries have been observed to use this backdoored software to install additional tools on target machines. The adversary-installed software establishing persistent communications with a command-and-control (C2) server using Windows sockets and WinHTTP requests. Once successfully connected, it transmits data about the compromised host, including hostname, operating system details, processor architecture, program working directory and the user name to the C2. ref 1 |
live |
| T1071.001 Web Protocols | secondary impact | CVE-2024-4978 is a vulnerability where compromised software is signed and hosted on the legitimate software distribution website. Adversaries have been observed to use this backdoored software to install additional tools on target machines. The adversary-installed software establishing persistent communications with a command-and-control (C2) server using Windows sockets and WinHTTP requests. Once successfully connected, it transmits data about the compromised host, including hostname, operating system details, processor architecture, program working directory and the user name to the C2. ref 1 |
live |
| T1105 Ingress Tool Transfer | primary impact | CVE-2024-4978 is a vulnerability where compromised software is signed and hosted on the legitimate software distribution website. Adversaries have been observed to use this backdoored software to install additional tools on target machines. The adversary-installed software establishing persistent communications with a command-and-control (C2) server using Windows sockets and WinHTTP requests. Once successfully connected, it transmits data about the compromised host, including hostname, operating system details, processor architecture, program working directory and the user name to the C2. ref 1 |
live |
Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources
T1005 Data from Local System secondary impact
- DET0380 Detection of Local Data Collection Prior to Exfiltration
AN1070 WindowsAdversaries collecting local files via PowerShell, WMI, or direct file API calls often include recursive file listings, targeted file reads, and temporary file staging.Tunable:
TargetFilePathRegexParentProcessFilterAN1071 LinuxAdversaries using bash scripts or tools to recursively enumerate user home directories, config files, or SSH keys.Tunable:TimeWindowScriptToolNameAN1072 macOSAdversary use of bash/zsh or AppleScript to locate files and exfil targets like user keychains or documents.Tunable:UserContextTargetVolumeAN1073 Network DevicesCollection of device configuration via CLI commands (e.g.,show running-config,copy flash,more), often followed by TFTP/SCP transfers.Tunable:CommandScopeAuthenticatedUserListAN1074 ESXiAdversaries accessing datastore or configuration files viavim-cmd,esxcli, or SCP to extract logs, VMs, or host configurations.Tunable:AccessPathRegexInteractiveShellUsage
Sigma rules tagged attack.t1005 (14)
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=windows category=process_creation · 0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
Author: Roberto Rodriguez @Cyb3rWard0g
· 2021-10-08 (modified 2023-11-30) · logsource: product=windows category=pipe_created · 1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3
Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database).
Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 22777c9e-873a-4b49-855f-6072ab861a52
Detects instances where an SMB service on an OpenCanary node has had a file open request.
Author: TropChaud
· 2022-12-19 (modified 2023-01-19) · logsource: product=windows category=process_creation · 24c77512-782b-448a-8950-eddb0785fc71
Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.
Author: frack113
· 2021-08-16 (modified 2023-05-04) · logsource: product=windows category=process_creation · 2f47f1fd-0901-466e-a770-3b7092834a1b
Detects a command used by conti to dump database
Author: frack113
· 2022-04-08 (modified 2023-01-19) · logsource: product=windows category=process_creation · 4833155a-4053-4c9c-a997-777fcea0baa7
Detect usage of the "sqlite" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.
Author: Diogo Braz
· 2020-04-16 (modified 2022-10-05) · logsource: product=aws service=cloudtrail · 54b9a76a-3c71-4673-b4b3-2edb4566ea7b
An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-05-04 · logsource: product=windows category=process_creation · 696bfb54-227e-4602-ac5b-30d9d2053312
Detects potentially suspicious SQL queries using SQLCmd targeting the Veeam backup databases in order to steal information.
Author: frack113
· 2022-02-13 (modified 2024-03-05) · logsource: product=windows category=process_creation · 6a69f62d-ce75-4b57-8dce-6351eb55b362
One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by using the built-in utility esentutl.exe
Author: Jason Mull
· 2025-05-12 · logsource: product=windows service=system · 882fbe50-d8d7-4e29-ae80-0648a8556866
Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID.
Author: frack113
· 2021-12-20 (modified 2023-02-13) · logsource: product=windows category=process_creation · b57ba453-b384-4ab9-9f40-1038086b4e53
Detects dump of credentials in VeeamBackup dbo
Author: Austin Clark
· 2019-08-11 (modified 2023-01-04) · logsource: product=cisco service=aaa · cd072b25-a418-4f98-8ebc-5093fb38fe1a
Collect pertinent data from the configuration files
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-09-24 · logsource: product=linux category=process_creation · efd2eb09-b72e-4a61-8dc7-b1382a1e8983
Detects potential Shai Hulud NPM package attack attempting to exfiltrate data via curl to external webhook sites.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=linux category=process_creation · f0025a69-e1b7-4dda-a53c-db21fa2d4071
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
T1071.001 Web Protocols secondary impact
- DET0027 Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets
AN0075 WindowsDetects unexpected or high-volume HTTP/S/WebSocket communication from suspicious processes (e.g., PowerShell, rundll32) using uncommon user agents or mimicking browser traffic to unusual domains or IPs.Tunable:
ProcessNameExclusionsUserAgentAnomaliesOutboundByteRatioThresholdAN0076 LinuxDetects curl, wget, Python requests, or custom HTTP clients communicating over non-standard ports, with repetitive or beacon-like patterns or POST-heavy behavior to rare domains.Tunable:CommandLinePatternMatchBeaconIntervalWindowAN0077 macOSDetects applications such as Automator, AppleScript, or LaunchDaemons invoking HTTP/S traffic to non-standard domains or using suspicious headers (e.g., Base64 in URIs or cookie fields).Tunable:SuspiciousParentProcessURIEntropyThresholdAN0078 ESXiDetects HTTP or HTTPS communication initiated by shell-based scripts or management daemons, especially those reaching public IPs over ports 80/443 using embedded curl or wget.Tunable:ShellScriptMatchExternalConnectionFilterAN0079 Network DevicesDetects Web protocol misuse such as encoded HTTP headers, WebSocket upgrade requests with abnormal payloads, or TLS handshake anomalies suggesting embedded C2 channels.Tunable:HeaderEncodingPatternTLSFingerprintMismatch
Sigma rules tagged attack.t1071.001 (42)
Author: citron_ninja
· 2023-10-25 (modified 2023-11-20) · logsource: product=windows category=dns_query · 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b
Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Author: Florian Roth (Nextron Systems)
· 2017-07-08 (modified 2021-11-27) · logsource: category=proxy · 21e44d78-95e7-421b-a464-ffd8395659c4
Detects a potentially suspicious empty user agent strings in proxy log.
Could potentially indicate an uncommon request method.
Author: Florian Roth (Nextron Systems)
· 2020-04-15 (modified 2021-11-27) · logsource: category=proxy · 2b1ee7e4-89b6-4739-b7bb-b811b6607e5e
Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-09-28 (modified 2025-10-29) · logsource: product=windows category=process_creation · 2cf29f11-e356-4f61-98c0-1bdb9393d6da
Detects renamed Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel
Author: Florian Roth (Nextron Systems)
· 2021-06-09 (modified 2024-02-15) · logsource: category=proxy · 304810ed-8853-437f-9e36-c4975c3dfd7e
Detects Baby Shark C2 Framework default communication patterns
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-10-25 · logsource: product=windows category=process_creation · 30bf1789-379d-4fdc-900f-55cd0a90a801
Detects the installation of VsCode tunnel (code-tunnel) as a service.
Author: frack113
· 2022-01-23 (modified 2023-02-21) · logsource: product=windows category=process_creation · 3286d37a-00fd-41c2-a624-a672dcd34e60
Detects execution of curl.exe with custom useragent options
Author: CertainlyP
· 2024-04-26 · logsource: product=windows category=network_connection · 37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1
Detects outbound network connection initiated by Microsoft Dialer.
The Microsoft Dialer, also known as Phone Dialer, is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to provide users with a graphical interface for managing phone calls via a modem or a phone line connected to the computer.
This is an outdated process in the current conext of it's usage and is a common target for info stealers for process injection, and is used to make C2 connections, common example is "Rhadamanthys"
Author: Mike Wade
· 2020-09-16 (modified 2022-03-24) · logsource: category=dns · 3eaf6218-3bed-4d8a-8707-274096f12a18
Detects wannacry killswitch domain dns queries
Author: Florian Roth (Nextron Systems)
· 2019-12-05 (modified 2023-01-19) · logsource: category=proxy · 5468045b-4fcc-4d1a-973c-c9c9578edacb
Detects direct access to raw pastes in different paste services often used by malware in their second stages to download malicious code in encrypted or encoded form
Author: Thomas Patzke
· 2019-11-12 (modified 2023-05-18) · logsource: category=proxy · 5ba715b6-71b7-44fd-8245-f66893e81b3d
Detects suspicious user agent string of APT40 Dropbox tool
Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2017-07-08 (modified 2024-04-14) · logsource: category=proxy · 5c84856b-55a5-45f1-826f-13f37250cf4e
Detects suspicious user agent strings used by malware in proxy logs
Author: Florian Roth (Nextron Systems), Markus Neis
· 2019-11-12 (modified 2024-02-15) · logsource: category=proxy · 6ec820f2-e963-4801-9127-d8b2dce4d31b
Detects suspicious user agent strings used in APT malware in proxy logs
Author: Florian Roth (Nextron Systems)
· 2017-07-08 (modified 2022-10-31) · logsource: category=proxy · 7195a772-4b3f-43a4-a210-6a003d65caa1
Detects suspicious malformed user agent strings in proxy logs
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-01 · logsource: category=dns · 73e5d24f-493f-4092-bd2f-c72cabda40ee
Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
This detection detects endpoints attempting to resolve the attacker's C2 domain (sfrclak.com) used for command and control communication.
All 42 rules on the technique page →
T1105 Ingress Tool Transfer primary impact
- DET0060 Detect Ingress Tool Transfers via Behavioral Chain
AN0165 WindowsUnusual or uncommon processes initiate network connections to external destinations followed by file creation (tools downloaded).Tunable:
ParentProcessNameDestinationIPCategoryFilePathRegexAN0166 LinuxShell-based tools (curl, wget, scp) initiate connections to external domains followed by creation of executable files on disk.Tunable:ToolNameDownloadExtensionAN0167 macOSProcess execution of curl or wget followed by a network connection and a file created in temporary or user-specific directories.Tunable:DirectoryTargetedProcessPathAN0168 ESXiCommand line interface or vCLI triggers remote transfer using wget or curl, writing files into datastore paths or local tmp directories.Tunable:ToolNameDatastorePathAN0169 Network DevicesNetwork device logs show anomalous inbound file transfers or uncharacteristic flows with high payload volume to network devices with storage or automation hooks.Tunable:PayloadVolumeThresholdProtocolUsed
Sigma rules tagged attack.t1105 (87)
Author: Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update)
· 2022-09-15 (modified 2023-05-02) · logsource: product=linux category=process_creation · 00b90cc1-17ec-402c-96ad-3a8117d7a582
Detects a suspicious curl process start the adds a file to a web request
Author: Florian Roth (Nextron Systems), Cedric MAURUGEON (Update)
· 2020-07-03 (modified 2023-05-02) · logsource: product=windows category=process_creation · 00bca14a-df4e-4649-9054-3f2aa676bc04
Detects the execution of the "curl" process with "upload" flags. Which might indicate potential data exfiltration
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2021-12-27 (modified 2022-08-02) · logsource: product=windows category=process_creation · 00d49ed5-4491-4271-a8db-650a4ef6f8c1
Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents
Author: frack113
· 2022-12-25 · logsource: product=windows category=process_creation · 02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf
Detects usage of COM objects that can be abused to download files in PowerShell by CLSID
Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)
· 2020-10-05 (modified 2024-03-05) · logsource: product=windows category=process_creation · 04936b66-3915-43ad-a8e5-809eadfd1141
Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-06-13 · logsource: product=windows category=image_load · 04fc4b22-91a6-495a-879d-0144fec5ec03
Detects potential exploitation of remote code execution vulnerability CVE-2025-33053
by monitoring suspicious image loads from WebDAV paths. The exploit involves malicious executables from
attacker-controlled WebDAV servers loading the Windows system DLLs like gdi32.dll, netapi32.dll, etc.
Author: frack113
· 2022-08-28 (modified 2024-05-31) · logsource: product=windows category=network_connection · 08249dc0-a28d-4555-8ba5-9255a198e08c
Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-01 · logsource: product=linux category=process_creation · 0a23a62d-c5b3-468b-a072-25064a9a8c87
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.
Author: frack113, Florian Roth (Nextron Systems)
· 2022-09-02 (modified 2024-05-31) · logsource: product=windows category=network_connection · 0dba975d-a193-4ed1-a067-424df57570d1
Detects a network connection initiated by the certutil.exe utility.
Attackers can abuse the utility in order to download malware or additional payloads.
Author: Sreeman, Florian Roth (Nextron Systems)
· 2022-01-04 (modified 2025-10-07) · logsource: product=windows category=process_creation · 0e8cfe08-02c9-4815-a2f8-0d157b7ed33e
Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files
Author: Florian Roth (Nextron Systems), Hieu Tran
· 2023-03-13 (modified 2025-07-18) · logsource: product=windows category=process_creation · 0f0450f3-8b47-441e-a31b-15a91dc243e2
Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets.
Author: Sohan G (D4rkCiph3r), Red Canary (idea)
· 2023-08-22 · logsource: product=macos category=process_creation · 13db8d2e-7723-4c2c-93c1-a4d36994f7ef
Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-02-15 (modified 2025-12-01) · logsource: product=windows category=process_creation · 13e6fe51-d478-4c7e-b0f2-6da9b400a829
Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.
Author: frack113
· 2021-11-26 (modified 2022-08-13) · logsource: product=windows category=process_creation · 185d7418-f250-42d0-b72e-0c8b70661e93
Download and compress a remote file and store it in a cab file on local machine.
Author: Florian Roth (Nextron Systems)
· 2017-11-08 (modified 2023-05-18) · logsource: category=proxy · 195c1119-ef07-4909-bb12-e66f5e07bf3c
Detects download of certain file types from hosts with dynamic DNS names (selected list)
All 87 rules on the technique page →
T1195.002 Compromise Software Supply Chain exploitation technique
- DET0309 Compromised software/update chain (installer/write → first-run/child → egress/signature anomaly)
AN0862 WindowsAdversary ships a tampered application or update: an updater/installer (msiexec/setup/update.exe/vendor service) writes or replaces binaries; on first run it spawns scripts/shells or unsigned DLLs and beacons to non-approved update CDNs/hosts. Detection correlates: (1) process creation of installer/updater → (2) file metadata changes in program paths → (3) first-run children and module/signature anomalies → (4) outbound connections to unexpected hosts within a short window.WinEventLog:Microsoft-Windows-CodeIntegrity/Operational
Unsigned or invalid image for newly installed/updated binaries→ DC0059 File MetadataNSM:FlowFirst-time egress to non-approved update hosts right after install/update→ DC0078 Network Traffic FlowTunable:TimeWindowApprovedUpdateHostsApprovedSignersProgramPathsAN0863 LinuxA compromised package/update (deb/rpm/tarball/AppImage/vendor updater) is installed, writing/overwriting files in /usr/local/bin, /usr/bin, /opt, or ~/.local; first run executes unexpected shells/curl/wget and connects to unapproved hosts. Correlate package/updater execution → file writes/replace → first-run child processes → egress.journald:packagedpkg/apt/yum/dnf transaction logs; vendor updaters in systemd journals→ DC0059 File MetadataTunable:PathScopeApprovedReposTimeWindowAN0864 macOSA tampered app/pkg/notarized update is installed via installer, softwareupdated, Homebrew, or vendor updater; new Mach-O or bundle contents appear in /Applications, /Library, /usr/local or /opt/homebrew; first run spawns sh/zsh/osascript/curl and makes egress to unfamiliar domains; AMFI/Gatekeeper may log signature/notarization problems.Tunable:AllowedTeamIDsBrewTapsAllowListTimeWindow
Sigma rules tagged attack.t1195.002 (17)
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-01 · logsource: product=linux category=process_creation · 0a23a62d-c5b3-468b-a072-25064a9a8c87
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-02-02 (modified 2026-03-16) · logsource: product=windows category=dns_query · 2074e137-1b73-4e2d-88ba-5a3407dbdce0
Detects when the Notepad++ updater (gup.exe) makes DNS queries to domains that are not part of the known legitimate update infrastructure.
This could indicate potential exploitation of the updater mechanism or suspicious network activity that warrants further investigation.
Author: Leonardo Gasparini
· 2026-05-12 · logsource: product=linux category=file_event · 2b5e4d3f-7c9a-4fab-a8d1-3e6f5a7b8c9d
Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-01 · logsource: product=macos category=file_event · 2db0458c-05c9-4069-a26f-77becd9c8c13
Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. Axios is a popular JavaScript HTTP client.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-03-30 · logsource: product=linux category=process_creation · 36603778-030c-43c4-8cbb-cd3c1d1a80c7
Detects process executions related to the backdoored versions of LiteLLM (v1.82.7 or v1.82.8).
In March 2026, a supply chain attack was discovered involving the popular open-source LLM framework LiteLLM by Threat Actor TeamPCP.
The malicious package harvests every credential on the system, encrypts and exfiltrates them, and installs a persistent C2 backdoor.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-02-03 (modified 2026-03-16) · logsource: product=windows category=file_event · 3b8f4c92-6a51-4d7e-9c3a-8e2d1f5a7b09
Detects when the Notepad++ updater (gup.exe) creates files in suspicious or uncommon locations.
This could indicate potential exploitation of the updater component to deliver unwanted malware or unwarranted files.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-28 · logsource: product=linux category=process_creation · 514f533b-f56e-421d-80b0-f7706a3e9d23
Detects the command-line installation of specific malicious npm packages and versions associated with the Shai-Hulud 2.0 supply chain attack.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=windows category=process_creation · 5299fadf-f228-4526-8274-251db1960be9
Detects the execution of `bun_environment.js` via the Bun runtime, a behavior associated with the Shai-Hulud "Second Coming" NPM supply chain attack.
The malware uses a `setup_bun.js` script to install the Bun runtime if not present, and then executes the malicious `bun_environment.js` payload.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-03-30 · logsource: product=linux category=file_event · 81c0b7f5-81c9-435e-a291-bc32fc2b72cd
Detects the creation of specific persistence files as observed in the LiteLLM PyPI supply chain attack.
In March 2026, a supply chain attack was discovered involving the popular open-source LLM framework LiteLLM by Threat Actor TeamPCP.
The malicious package harvests every credential on the system, encrypts and exfiltrates them, and installs a persistent C2 backdoor.
Author: Leonardo Gasparini
· 2026-05-12 · logsource: product=windows category=file_event · 8a3f2c1e-5d7b-4e9a-b6c8-1f2a3d4e5f6a
Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai, uipath, etc reported on early May 2026.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-01 · logsource: product=macos category=process_creation · a09ee860-31b3-4586-8a68-0ebd74ce0e5f
Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-01 · logsource: product=linux category=file_event · b7cb840c-11f6-47f7-b3ef-5524739c9077
Detects file creation events linked to the Axios NPM supply chain compromise. Axios is a popular JavaScript HTTP client.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-28 · logsource: product=windows category=process_creation · bae7c70b-8569-44e9-accf-b30073da8a5d
Detects the command-line installation of specific malicious npm packages and versions associated with the Shai-Hulud 2.0 supply chain attack.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-02-03 · logsource: product=windows category=process_creation · bb0e87ce-c89f-4857-84fa-095e4483e9cb
Detects suspicious child process creation by the Notepad++ updater process (gup.exe).
This could indicate potential exploitation of the updater component to deliver unwanted malware.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-01 · logsource: product=windows category=file_event · cd6386fa-bb9a-4b67-b006-786b6ab5d2ba
Detects file creation events linked to the Axios NPM supply chain compromise. Axios is a popular JavaScript HTTP client.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.
The attack used cscript.exe (VBScript), curl.exe (C2), and PowerShell masquerading as Windows Terminal.