Detections

Analysis of Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery

Suspicious Execution Pattern - Unpacking the AsyncAPI npm supply chain compromise

sigma · generated; parse required before publication

title: Suspicious Execution Pattern - Unpacking the AsyncAPI npm supply chain compromise
description: Detects anomalous process execution patterns documented in public threat
  intelligence.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    process.command_line: node.exe
    process.parent.name: npm.cmd
  condition: selection
level: medium
tags: []
references: []

asyncapi_supply_chain_payload

yara · compile required before publication

rule asyncapi_supply_chain_payload {
  strings:
    $s1 = "miasma_payload" ascii wide nocase
    $s2 = "ipfs_fetch" ascii wide nocase
  condition:
    any of them
}