Hunt
Analysis of Node.js Trust Falls: Dangerous Module Resolution on Windows
Hunt Strategy & Objective
Hunt for insecure DLLs or binary modules (.node) executed by node.exe outside standard package directories.
⏱️ Lookback: 30 days
Hunt Hypothesis
Threat actors may have deployed activity documented in Node.js Trust Falls: Dangerous Module Resolution on Windows.
Target Platforms & Environment
Windows
Linux
Network Security
Enterprise endpoints, cloud identities, and network telemetry.
Required Telemetry & Data Sources
Process creation
DNS logs
Authentication logs
Network flows
Procedural Hunting Sequence
- 1 Filter Sysmon Event ID 7 (Image Loaded) for node.exe loading DLLs from %TEMP% or user directories.
- 2 Inspect Node.js package manifests for path traversal sequences in require statements.
- 3 Review developers and CI/CD pipelines for untrusted npm package execution.
- 4 Check for unauthorized changes to NODE_PATH environment variables.
Hunt Queries
Query Pattern 1
index=windows EventCode=7 Image=*node.exe (ImageLoaded=*\\AppData\\Local\\Temp* OR ImageLoaded=*\\Users\\Public*) | table _time, Computer, ImageLoaded
Query Pattern 2
DeviceImageLoadEvents | where InitiatingProcessFileName =~ 'node.exe' and (FolderPath has 'AppData\\Local\\Temp' or FolderPath has 'Users\\Public') | project Timestamp, DeviceName, FileName, FolderPath
✓
True Positive Confirmation Evidence
●
Anomalous binary execution
●
Unexpected child processes
●
C2 beaconing
!
Benign & False Positive Explanations
●
Scheduled backup scripts and authorized administrative utilities
Validation Checklist
Correlate timestamps with system activity
Confirm source authenticity
Escalation Criteria
Confirmed unapproved execution with suspicious outbound connections