Hayabusa medium experimental sigma

Unsigned .node File Loaded

Detects the loading of unsigned .node files. Adversaries may abuse a lack of .node integrity checking to execute arbitrary code inside of trusted applications such as Slack. .node files are native add-ons for Electron-based applications, which are commonly used for desktop applications like Slack, Discord, and Visual Studio Code. This technique has been observed in the DripLoader malware, which uses unsigned .node files to load malicious native code into Electron applications.

View Source

Detection Logic

{
  "image_load": {
    "EventID": 7,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection_node_extension": {
    "ImageLoaded
| endswith": ".node"
  },
  "selection_status": [
    {
      "Signed": "false"
    },
    {
      "SignatureStatus": "Unavailable"
    }
  ],
  "filter_optional_vscode_jupyter": {
    "Image
| endswith": "\\Code.exe",
    "ImageLoaded
| contains": ".vscode\\extensions\\ms-toolsai.jupyter-",
    "ImageLoaded
| endswith": [
      "\\electron.napi.node",
      "\\node.napi.glibc.node"
    ]
  },
  "filter_optional_vscode_core": {
    "Image
| contains": "\\Microsoft VS Code\\Code.exe",
    "ImageLoaded
| contains": "\\Microsoft VS Code\\resources\\app\\node_modules"
  },
  "filter_optional_evernote": {
    "Image
| contains": [
      "C:\\Program Files (x86)\\",
      "C:\\Program Files\\",
      "\\AppData\\Local\\Programs\\"
    ],
    "Image
| endswith": "\\Evernote\\Evernote.exe",
    "ImageLoaded
| contains": "\\Evernote\\resources\\app"
  },
  "condition": "image_load and (all of selection_* and not 1 of filter_optional_*)"
}

False Positives

⚠ VsCode extensions or similar legitimate tools might use unsigned .node files. These should be investigated on a case-by-case basis, and whitelisted if determined to be benign.

Field Validations

Loading…

Comments (0)

Loading comments...