Elastic Defend high stable eql

Silent NPM Package Install Command

Detects when Node or NPM is used to install a package or packages using options to hide the installation using the following options: "--no-warnings", "--no-progress", and "--loglevel silent". Malicious packages will install required dependencies in order to function and will use these options in order to hide it from the user.

View Source

Detection Logic

process where event.type == "start" and process.name in ("node", "npm", "npx") and 
 process.args in ("install", "i", "in", "ins", "inst", "instal", "add", "isnt", "isnta", "isntal", "isntall") and 
 process.args == "--no-save" and 
 process.args == "--no-progress" and 
 ((process.args == "--loglevel" and process.args == "silent") or 
  (process.args in ("-s", "--silent")))

Field Validations

Loading…

Comments (0)

Loading comments...