{"id":"T1059.007","name":"JavaScript","url":"https://attack.mitre.org/techniques/T1059/007","tactics":["execution"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0264","stix_id":"x-mitre-detection-strategy--6dd441e4-d264-4f7f-b145-9c122955c532","name":"Cross-Platform Detection of JavaScript Execution Abuse","url":"https://attack.mitre.org/detectionstrategies/DET0264","analytics":[{"id":"AN0733","stix_id":"x-mitre-analytic--3f257014-01d4-487d-980c-77d4d2130315","name":"Analytic 0733","description":"Detects JavaScript execution through WSH (wscript.exe, cscript.exe) or HTA (mshta.exe), particularly when spawned from Office macros, web browsers, or abnormal user paths. Correlates script execution with outbound network activity or system modification.","url":"https://attack.mitre.org/detectionstrategies/DET0264#AN0733","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"m365:defender","channel":"ScriptBlockLogging + AMSI","data_component":"DC0029","data_component_name":"Script Execution","log_source_slug":"m365-defender"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"ParentProcess","description":"Execution of wscript.exe, cscript.exe, or mshta.exe from suspicious parent like Excel or Outlook."},{"field":"ScriptPath","description":"Script loaded from %TEMP%, user download folder, or via UNC/web path."},{"field":"TimeWindow","description":"Execution of JavaScript during non-business or patch windows."},{"field":"UserContext","description":"Execution by accounts not typically authorized for scripting (e.g., non-admin users)."},{"field":"EntropyScore","description":"Obfuscated JS with high entropy detected by AMSI or ScriptBlock logging."}],"live":true,"detection_strategies":["DET0264"],"techniques":["T1059.007"]},{"id":"AN0734","stix_id":"x-mitre-analytic--af3dff40-40be-40dd-9a0e-a47cf052880b","name":"Analytic 0734","description":"Detects JavaScript for Automation (JXA) via osascript or compiled scripts using OSAKit APIs. Flags execution involving system modification, inter-process scripting, or browser abuse.","url":"https://attack.mitre.org/detectionstrategies/DET0264#AN0734","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"log stream with predicate 'eventMessage CONTAINS \"osascript\"'","data_component":"DC0029","data_component_name":"Script Execution","log_source_slug":"macos-unifiedlog"},{"name":"macos:osquery","channel":"process_events","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-osquery"},{"name":"macos:syslog","channel":"/var/log/system.log","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"macos-syslog"}],"mutable_elements":[{"field":"ScriptLocation","description":"Execution of JXA from user-controlled paths like ~/Downloads or /Volumes."},{"field":"ParentProcess","description":"osascript invoked by third-party apps (VSCode, browsers, etc.)."},{"field":"APIInvocation","description":"Use of OSAKit API by apps not typically scripting-enabled."}],"live":true,"detection_strategies":["DET0264"],"techniques":["T1059.007"]},{"id":"AN0735","stix_id":"x-mitre-analytic--26520d1c-1e0a-443b-817e-7ec1846a0476","name":"Analytic 0735","description":"Detects Node.js or JavaScript interpreter execution from web shells, cron jobs, or local users. Correlates execution with reverse shell behavior, file modifications, or abnormal outbound connections.","url":"https://attack.mitre.org/detectionstrategies/DET0264#AN0735","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"linux:syslog","channel":"/var/log/syslog","data_component":"DC0029","data_component_name":"Script Execution","log_source_slug":"linux-syslog"}],"mutable_elements":[{"field":"ScriptPath","description":"Script launched from /tmp, /var/tmp, or hidden dot directories."},{"field":"BinaryName","description":"Custom compiled JS binaries like node_shell or interpreter disguises."},{"field":"UserExecutionContext","description":"Execution by service accounts or low-privilege users running cron scripts."},{"field":"NetworkFollowUp","description":"Connection attempts to C2 post-node.js execution."}],"live":true,"detection_strategies":["DET0264"],"techniques":["T1059.007"]}],"live":true,"version":"1.0","techniques":["T1059.007"]}],"sigma_rules":[{"id":"002bdb95-0cf1-46a6-9e08-d38c128a6127","title":"WScript or CScript Dropper - File","author":"Tim Shelton","status":"test","level":"high","date":"2022-01-10","modified":"2026-02-17","description":"Detects a file ending in jse, vbe, js, vba, vbs, wsf, wsh written by cscript.exe or wscript.exe","references":["WScript or CScript Dropper (cea72823-df4d-4567-950c-0b579eaf0846)"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.execution","attack.t1059.005","attack.t1059.007"],"path":"rules/windows/file/file_event/file_event_win_cscript_wscript_dropper.yml","techniques":["T1059.005","T1059.007"],"cves":[]},{"id":"05c36dd6-79d6-4a9a-97da-3db20298ab2d","title":"XSL Script Execution Via WMIC.EXE","author":"Timur Zinniatullin, oscd.community, Swachchhanda Shrawan Poudel","status":"test","level":"medium","date":"2019-10-21","modified":"2026-01-24","description":"Detects the execution of WMIC with the \"format\" flag to potentially load local XSL files.\nAdversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.\nExtensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1047","attack.t1220","attack.execution","attack.t1059.005","attack.t1059.007"],"path":"rules/windows/process_creation/proc_creation_win_wmic_xsl_script_processing.yml","techniques":["T1047","T1220","T1059.005","T1059.007"],"cves":[]},{"id":"0bcfabcb-7929-47f4-93d6-b33fb67d34d1","title":"Adwind RAT / JRAT File Artifact","author":"Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community","status":"test","level":"high","date":"2017-11-10","modified":"2022-12-02","description":"Detects javaw.exe in AppData folder as used by Adwind / JRAT","references":["https://www.hybrid-analysis.com/sample/ba86fa0d4b6af2db0656a88b1dd29f36fe362473ae8ad04255c4e52f214a541c?environmentId=100","https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.execution","attack.t1059.005","attack.t1059.007"],"path":"rules/windows/file/file_event/file_event_win_mal_adwind.yml","techniques":["T1059.005","T1059.007"],"cves":[]},{"id":"0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6","title":"Script Interpreter Spawning Credential Scanner - Windows","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-25","modified":null,"description":"Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).\nThis behavior is indicative of an attempt to find and steal secrets, as seen in the \"Shai-Hulud: The Second Coming\" campaign.\n","references":["https://github.com/asyncapi/cli/blob/2efa4dff59bc3d3cecdf897ccf178f99b115d63d/bun_environment.js","https://www.stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromised","https://www.endorlabs.com/learn/shai-hulud-2-malware-campaign-targets-github-and-cloud-credentials-using-bun-runtime","https://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1552","attack.collection","attack.execution","attack.t1005","attack.t1059.007"],"path":"rules/windows/process_creation/proc_creation_win_susp_script_interpretor_spawn_credential_scanner.yml","techniques":["T1552","T1005","T1059.007"],"cves":[]},{"id":"13db8d2e-7723-4c2c-93c1-a4d36994f7ef","title":"Potential In-Memory Download And Compile Of Payloads","author":"Sohan G (D4rkCiph3r), Red Canary (idea)","status":"test","level":"medium","date":"2023-08-22","modified":null,"description":"Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware","references":["https://redcanary.com/blog/mac-application-bundles/"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.command-and-control","attack.execution","attack.t1059.007","attack.t1105"],"path":"rules/macos/process_creation/proc_creation_macos_susp_in_memory_download_and_compile.yml","techniques":["T1059.007","T1105"],"cves":[]},{"id":"1e33157c-53b1-41ad-bbcc-780b80b58288","title":"WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript","author":"Michael Haag","status":"test","level":"medium","date":"2019-01-16","modified":"2026-02-17","description":"Detects script file execution (.js, .jse, .vba, .vbe, .vbs, .wsf, .wsh) by Wscript/Cscript.","references":["https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/","https://redcanary.com/blog/gootloader/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.005","attack.t1059.007","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_wscript_cscript_script_exec.yml","techniques":["T1059.005","T1059.007"],"cves":[]},{"id":"1fac1481-2dbc-48b2-9096-753c49b4ec71","title":"Adwind RAT / JRAT","author":"Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community","status":"test","level":"high","date":"2017-11-10","modified":"2022-10-09","description":"Detects javaw.exe in AppData folder as used by Adwind / JRAT","references":["https://www.hybrid-analysis.com/sample/ba86fa0d4b6af2db0656a88b1dd29f36fe362473ae8ad04255c4e52f214a541c?environmentId=100","https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.005","attack.t1059.007","detection.emerging-threats"],"path":"rules-emerging-threats/2017/Malware/Adwind-RAT/proc_creation_win_malware_adwind.yml","techniques":["T1059.005","T1059.007"],"cves":[]},{"id":"2b5e4d3f-7c9a-4fab-a8d1-3e6f5a7b8c9d","title":"TanStack Supply-Chain Attack File Creation Indicators - Linux","author":"Leonardo Gasparini","status":"experimental","level":"medium","date":"2026-05-12","modified":null,"description":"Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026.","references":["https://www.netskope.com/blog/shai-hulud-style-npm-worm-hits-tanstack","https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack","https://socket.dev/supply-chain-attacks/mini-shai-hulud","https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/"],"logsource":{"product":"linux","category":"file_event"},"tags":["attack.initial-access","attack.t1195.002","attack.execution","attack.t1059.007","attack.persistence","attack.privilege-escalation","attack.t1547.004","detection.emerging-threats"],"path":"rules-emerging-threats/2026/Malware/TanStack-Supply-Chain/file_event_lnx_malware_tanstack_supply_chain.yml","techniques":["T1195.002","T1059.007","T1547.004"],"cves":[]},{"id":"2e4e488a-6164-4811-9ea1-f960c7359c40","title":"HackTool - CACTUSTORCH Remote Thread Creation","author":"@SBousseaden (detection), Thomas Patzke (rule)","status":"test","level":"high","date":"2019-02-01","modified":"2023-05-05","description":"Detects remote thread creation from CACTUSTORCH as described in references.","references":["https://twitter.com/SBousseaden/status/1090588499517079552","https://github.com/mdsecactivebreach/CACTUSTORCH"],"logsource":{"product":"windows","category":"create_remote_thread"},"tags":["attack.privilege-escalation","attack.execution","attack.stealth","attack.t1055.012","attack.t1059.005","attack.t1059.007","attack.t1218.005"],"path":"rules/windows/create_remote_thread/create_remote_thread_win_hktl_cactustorch.yml","techniques":["T1055.012","T1059.005","T1059.007","T1218.005"],"cves":[]},{"id":"3c6f5e4a-8d0b-6abc-d9e2-4f7a6b8c9d0e","title":"TanStack Supply-Chain Attack Execution Indicators - Linux","author":"Leonardo Gasparini","status":"experimental","level":"high","date":"2026-05-12","modified":null,"description":"Detects process execution indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026.\nThe preinstall hook runs setup.mjs, which downloads a platform-specific Bun runtime.\n","references":["https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack","https://socket.dev/supply-chain-attacks/mini-shai-hulud","https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.t1059.007","attack.t1059.006","attack.t1204.002","detection.emerging-threats"],"path":"rules-emerging-threats/2026/Malware/TanStack-Supply-Chain/proc_creation_lnx_malware_tanstack_supply_chain.yml","techniques":["T1059.007","T1059.006","T1204.002"],"cves":[]},{"id":"401e5d00-b944-11ea-8f9a-00163ecd60ae","title":"AppLocker Prevented Application or Script from Running","author":"Pushkarev Dmitry","status":"test","level":"medium","date":"2020-06-28","modified":"2025-12-03","description":"Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.\n","references":["https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker","https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker","https://nxlog.co/documentation/nxlog-user-guide/applocker.html"],"logsource":{"product":"windows","service":"applocker"},"tags":["attack.execution","attack.t1204.002","attack.t1059.001","attack.t1059.003","attack.t1059.005","attack.t1059.006","attack.t1059.007"],"path":"rules/windows/builtin/applocker/win_applocker_application_was_prevented_from_running.yml","techniques":["T1204.002","T1059.001","T1059.003","T1059.005","T1059.006","T1059.007"],"cves":[]},{"id":"52cad028-0ff0-4854-8f67-d25dfcbc78b4","title":"HTML Help HH.EXE Suspicious Child Process","author":"Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2020-04-01","modified":"2023-04-12","description":"Detects a suspicious child process of a Microsoft HTML Help (HH.exe)","references":["https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/","https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-27939090904026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7","https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/","https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.initial-access","attack.stealth","attack.t1047","attack.t1059.001","attack.t1059.003","attack.t1059.005","attack.t1059.007","attack.t1218","attack.t1218.001","attack.t1218.010","attack.t1218.011","attack.t1566","attack.t1566.001"],"path":"rules/windows/process_creation/proc_creation_win_hh_html_help_susp_child_process.yml","techniques":["T1047","T1059.001","T1059.003","T1059.005","T1059.007","T1218","T1218.001","T1218.010","T1218.011","T1566","T1566.001"],"cves":[]},{"id":"557e3bd3-7f21-495d-8d50-7c8bdfb8041c","title":"AppLocker Application Would Have Been Blocked","author":"heyyanu","status":"experimental","level":"medium","date":"2026-03-26","modified":null,"description":"Detects when AppLocker \"Audit only\" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker \"Enforce rules\" enforcement mode was enabled.\n","references":["https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker","https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker","https://www.splunk.com/en_us/blog/security/deploy-test-monitor-mastering-microsoft-applocker-part-2.html","https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/ee844150(v=ws.11)"],"logsource":{"product":"windows","service":"applocker"},"tags":["attack.execution","attack.t1204.002","attack.t1059.001","attack.t1059.003","attack.t1059.005","attack.t1059.006","attack.t1059.007"],"path":"rules/windows/builtin/applocker/win_applocker_application_would_have_been_blocked.yml","techniques":["T1204.002","T1059.001","T1059.003","T1059.005","T1059.006","T1059.007"],"cves":[]},{"id":"5cddf373-ef00-4112-ad72-960ac29bac34","title":"HackTool - Koadic Execution","author":"wagga, Jonhnathan Ribeiro, oscd.community","status":"test","level":"high","date":"2020-01-12","modified":"2023-02-11","description":"Detects command line parameters used by Koadic hack tool","references":["https://unit42.paloaltonetworks.com/unit42-sofacy-groups-parallel-attacks/","https://github.com/offsecginger/koadic/blob/457f9a3ff394c989cdb4c599ab90eb34fb2c762c/data/stager/js/stdlib.js","https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.003","attack.t1059.005","attack.t1059.007"],"path":"rules/windows/process_creation/proc_creation_win_hktl_koadic.yml","techniques":["T1059.003","T1059.005","T1059.007"],"cves":[]},{"id":"6c0ce3b6-85e2-49d4-9c3f-6e008ce9796e","title":"Suspicious Deno File Written from Remote Source","author":"Josh Nickels, Michael Taggart","status":"experimental","level":"low","date":"2025-05-22","modified":null,"description":"Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious DLL.\nThis behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.\n","references":["https://taggart-tech.com/evildeno/"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.execution","attack.t1204","attack.t1059.007","attack.command-and-control","attack.t1105"],"path":"rules/windows/file/file_event/file_event_win_creation_deno.yml","techniques":["T1204","T1059.007","T1105"],"cves":[]},{"id":"8537c866-072e-460d-bfff-aaf39cbd73d3","title":"Potentially Suspicious Inline JavaScript Execution via NodeJS Binary","author":"Microsoft (idea), Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-04-21","modified":null,"description":"Detects potentially suspicious inline JavaScript execution using Node.js with specific keywords in the command line.","references":["https://www.microsoft.com/en-us/security/blog/2025/04/15/threat-actors-misuse-node-js-to-deliver-malware-and-other-malicious-payloads/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.007"],"path":"rules/windows/process_creation/proc_creation_win_susp_inline_node_js_execution.yml","techniques":["T1059.007"],"cves":[]},{"id":"8a3f2c1e-5d7b-4e9a-b6c8-1f2a3d4e5f6a","title":"TanStack Supply-Chain Attack File Creation Indicators - Windows","author":"Leonardo Gasparini","status":"experimental","level":"medium","date":"2026-05-12","modified":null,"description":"Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai, uipath, etc reported on early May 2026.","references":["https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack","https://socket.dev/supply-chain-attacks/mini-shai-hulud","https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.initial-access","attack.t1195.002","attack.execution","attack.t1059.007","attack.persistence","attack.t1554","detection.emerging-threats"],"path":"rules-emerging-threats/2026/Malware/TanStack-Supply-Chain/file_event_win_malware_tanstack_supply_chain.yml","techniques":["T1195.002","T1059.007","T1554"],"cves":[]},{"id":"8d63dadf-b91b-4187-87b6-34a1114577ea","title":"Potential Remote SquiblyTwo Technique Execution","author":"Markus Neis, Florian Roth, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"test","level":"high","date":"2019-01-16","modified":"2026-01-24","description":"Detects potential execution of the SquiblyTwo technique that leverages Windows Management Instrumentation (WMI)\nto execute malicious code remotely. This technique bypasses application whitelisting by using wmic.exe to process\nmalicious XSL (eXtensible Stylesheet Language) scripts that can contain embedded JScript or VBScript.\nThe attack typically works by fetching XSL content from a remote source (using HTTP/HTTPS) and executing it\nwith full trust privileges directly in memory, avoiding disk-based detection mechanisms. This is a common\nLOLBin (Living Off The Land Binary) technique used for defense evasion and code execution.\n","references":["https://web.archive.org/web/20190209154607/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html","https://twitter.com/mattifestation/status/986280382042595328","https://atomicredteam.io/defense-evasion/T1220/","https://lolbas-project.github.io/lolbas/Binaries/Wmic/","https://x.com/byrne_emmy12099/status/1932346420226658668"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1047","attack.t1220","attack.execution","attack.t1059.005","attack.t1059.007"],"path":"rules/windows/process_creation/proc_creation_win_wmic_squiblytwo_bypass.yml","techniques":["T1047","T1220","T1059.005","T1059.007"],"cves":[]},{"id":"99b7460d-c9f1-40d7-a316-1f36f61d52ee","title":"Cscript/Wscript Uncommon Script Extension Execution","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-05-15","modified":"2023-06-19","description":"Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension","references":["Internal Research"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.005","attack.t1059.007"],"path":"rules/windows/process_creation/proc_creation_win_wscript_cscript_uncommon_extension_exec.yml","techniques":["T1059.005","T1059.007"],"cves":[]},{"id":"9b4f3d2e-6e8c-5fab-c7d9-2a3b4e5f6a7b","title":"TanStack Supply-Chain Attack Execution Indicators - Windows","author":"Leonardo Gasparini","status":"experimental","level":"high","date":"2026-05-12","modified":null,"description":"Detects process execution indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai, uipath reported on early May 2026.","references":["https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack","https://socket.dev/supply-chain-attacks/mini-shai-hulud","https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.007","attack.t1204.002","detection.emerging-threats"],"path":"rules-emerging-threats/2026/Malware/TanStack-Supply-Chain/proc_creation_win_malware_tanstack_supply_chain.yml","techniques":["T1059.007","T1204.002"],"cves":[]},{"id":"afa71271-6a97-4e47-810f-83120fb1a4ce","title":"New Agent Skills Installation Attempt Via Node.EXE","author":"Marco Pedrinazzi (@pedrinazziM) (InTheCyber)","status":"experimental","level":"medium","date":"2026-02-03","modified":null,"description":"Detects the attempt to install new skills for AI agents using the \"npx skills\" command.\nAgent skills enhance AI agents with new capabilities, but attackers may abuse this mechanism to inject malicious commands executed by the agent on behalf of the user.\nThe \"npx skills\" command can install skills for various agents (e.g., Claude Code, Cursor, and others).\nAnalysts should review any installed skills to verify their legitimacy.\nNote: Tune this rule based on whether AI agent tooling is allowed in your environment.\nIn environments where such tooling is authorized, this detection may reflect normal activity and the alert level should be adjusted accordingly.\nIn environments where AI agent tooling is not permitted, this activity is likely suspicious and may require immediate investigation.\n","references":["https://blog.lukaszolejnik.com/supply-chain-risk-of-agentic-ai-infecting-infrastructures-via-skill-worms/","https://github.com/vercel-labs/skills/blob/1f7fbc8d0e49c4e0601d364696bd1bdd15e80967/README.md","https://opensourcemalware.com/blog/clawdbot-skills-ganked-your-crypto","https://promptintel.novahunting.ai/molt"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.007"],"path":"rules/windows/process_creation/proc_creation_win_node_new_agent_skills_installed.yml","techniques":["T1059.007"],"cves":[]},{"id":"b730a276-6b63-41b8-bcf8-55930c8fc6ee","title":"Csc.EXE Execution Form Potentially Suspicious Parent","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)","status":"test","level":"high","date":"2019-02-11","modified":"2026-03-23","description":"Detects a potentially suspicious parent of \"csc.exe\", which could be a sign of payload delivery.","references":["https://www.uptycs.com/blog/warzonerat-can-now-evade-with-process-hollowing","https://reaqta.com/2017/11/short-journey-darkvnc/","https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.005","attack.t1059.007","attack.t1218.005","attack.t1027.004"],"path":"rules/windows/process_creation/proc_creation_win_csc_susp_parent.yml","techniques":["T1059.005","T1059.007","T1218.005","T1027.004"],"cves":[]},{"id":"ba3874b9-0fae-465f-836c-eb5d071a1789","title":"NodeJS Execution of JavaScript File","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"low","date":"2025-04-21","modified":null,"description":"Detects execution of JavaScript or JSC files using NodeJs binary node.exe, that could be potentially suspicious.\nNode.js is a popular open-source JavaScript runtime that runs code outside browsers and is widely used for both frontend and backend development.\nAdversaries have been observed abusing Node.js to disguise malware as legitimate processes, evade security defenses, and maintain persistence within target systems.\nBecause Node.js is commonly used, this rule may generate false positives in some environments. However, if such activity is unusual in your environment, it is highly suspicious and warrants immediate investigation.\n","references":["https://www.microsoft.com/en-us/security/blog/2025/04/15/threat-actors-misuse-node-js-to-deliver-malware-and-other-malicious-payloads/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.007"],"path":"rules/windows/process_creation/proc_creation_win_security_susp_node_js_execution.yml","techniques":["T1059.007"],"cves":[]},{"id":"cc7abbd0-762b-41e3-8a26-57ad50d2eea3","title":"MSHTA Execution with Suspicious File Extensions","author":"Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule), Swachchhanda Shrawan Poudel (Nextron Systems)","status":"test","level":"high","date":"2019-02-22","modified":"2025-05-12","description":"Detects execution of mshta.exe with file types that looks like they do not typically represent HTA (HTML Application) content,\nsuch as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications\ncontaining VBScript or JScript. Threat actors often abuse this lolbin utility to download and\nexecute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.\n","references":["http://blog.sevagas.com/?Hacking-around-HTA-files","https://0x00sec.org/t/clientside-exploitation-in-2018-how-pentesting-has-changed/7356","https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/xml/xslt/xslt-stylesheet-scripting-using-msxsl-script","https://medium.com/tsscyber/pentesting-and-hta-bypassing-powershell-constrained-language-mode-53a42856c997","https://twitter.com/mattifestation/status/1326228491302563846","https://www.virustotal.com/gui/file/c1f27d9795a2eba630db8a043580a0761798f06370fb1317067805f8a845b00c"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1140","attack.t1218.005","attack.execution","attack.t1059.007","cve.2020-1599"],"path":"rules/windows/process_creation/proc_creation_win_mshta_susp_execution.yml","techniques":["T1140","T1218.005","T1059.007"],"cves":["CVE-2020-1599"]},{"id":"cea72823-df4d-4567-950c-0b579eaf0846","title":"Potential Dropper Script Execution Via WScript/CScript/MSHTA","author":"Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems), Dave Johnson","status":"test","level":"medium","date":"2019-01-16","modified":"2026-02-17","description":"Detects wscript/cscript/mshta executions of scripts located in user directories","references":["https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/","https://redcanary.com/blog/gootloader/","https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.005","attack.t1059.007"],"path":"rules/windows/process_creation/proc_creation_win_wscript_cscript_mshta_dropper.yml","techniques":["T1059.005","T1059.007"],"cves":[]},{"id":"df1f26d3-bea7-4700-9ea2-ad3e990cf90e","title":"Node Process Executions","author":"Max Altgelt (Nextron Systems)","status":"test","level":"medium","date":"2022-04-06","modified":null,"description":"Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud","references":["https://twitter.com/mttaggart/status/1511804863293784064"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1127","attack.t1059.007"],"path":"rules/windows/process_creation/proc_creation_win_node_adobe_creative_cloud_abuse.yml","techniques":["T1127","T1059.007"],"cves":[]},{"id":"e0cfaecd-602d-41af-988d-f6ccebb2af26","title":"Suspicious Installer Package Child Process","author":"Sohan G (D4rkCiph3r)","status":"test","level":"medium","date":"2023-02-18","modified":null,"description":"Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters","references":["https://redcanary.com/blog/clipping-silver-sparrows-wings/","https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/execution_installer_package_spawned_network_event.toml"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.t1059","attack.t1059.007","attack.t1071","attack.t1071.001","attack.execution","attack.command-and-control"],"path":"rules/macos/process_creation/proc_creation_macos_installer_susp_child_process.yml","techniques":["T1059","T1059.007","T1071","T1071.001"],"cves":[]},{"id":"e8a95b5e-c891-46e2-b33a-93937d3abc31","title":"Suspicious HH.EXE Execution","author":"Maxim Pavlunin","status":"test","level":"high","date":"2020-04-01","modified":"2023-04-12","description":"Detects a suspicious execution of a Microsoft HTML Help (HH.exe)","references":["https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/","https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-27939090904026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7","https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/","https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.initial-access","attack.stealth","attack.t1047","attack.t1059.001","attack.t1059.003","attack.t1059.005","attack.t1059.007","attack.t1218","attack.t1218.001","attack.t1218.010","attack.t1218.011","attack.t1566","attack.t1566.001"],"path":"rules/windows/process_creation/proc_creation_win_hh_susp_execution.yml","techniques":["T1047","T1059.001","T1059.003","T1059.005","T1059.007","T1218","T1218.001","T1218.010","T1218.011","T1566","T1566.001"],"cves":[]},{"id":"f1408a58-0e94-4165-b80a-da9f96cf6fc3","title":"JXA In-memory Execution Via OSAScript","author":"Sohan G (D4rkCiph3r)","status":"test","level":"high","date":"2023-01-31","modified":null,"description":"Detects possible malicious execution of JXA in-memory via OSAScript","references":["https://redcanary.com/blog/applescript/"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.t1059.002","attack.t1059.007","attack.execution"],"path":"rules/macos/process_creation/proc_creation_macos_jxa_in_memory_execution.yml","techniques":["T1059.002","T1059.007"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2025-34028","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-5631","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-22515","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-26360","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2022-22963","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2018-4990","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2015-5119","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2013-3346","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-24682","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2021-21166","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-21148","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-37975","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-30554","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2021-21206","state":"mapped","mapping_types":["exploitation_technique"]}],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}