Elastic Defend high stable eql

Application Javascript Injection via Nodejs

Detects when a JavaScript file within an application's directory structure gets modified via Node.js. Malicious npm packages have been observed hijacking legitimate applications like Cursor editor by injecting malicious JavaScript code into application files to enable persistent code execution.

View Source

Detection Logic

file where event.action == "modification" and file.extension == "js" and
 file.path like "/Applications/*" and (process.name == "node" or Effective_process.name == "node") and 
 Effective_process.executable != "/Applications/Visual Studio Code 2.app/Contents/MacOS/Electron"

Field Validations

Loading…

Comments (0)

Loading comments...