Hermes CTI

← Back to canonical report

Hunt

Analysis of Node.js Trust Falls: Dangerous Module Resolution on Windows

Hunt Strategy & Objective

Hunt for insecure DLLs or binary modules (.node) executed by node.exe outside standard package directories.

⏱️ Lookback: 30 days

Hunt Hypothesis

Threat actors may have deployed activity documented in Node.js Trust Falls: Dangerous Module Resolution on Windows.

Target Platforms & Environment

Windows Linux Network Security

Enterprise endpoints, cloud identities, and network telemetry.

Required Telemetry & Data Sources

Process creation DNS logs Authentication logs Network flows

Procedural Hunting Sequence

  1. 1 Filter Sysmon Event ID 7 (Image Loaded) for node.exe loading DLLs from %TEMP% or user directories.
  2. 2 Inspect Node.js package manifests for path traversal sequences in require statements.
  3. 3 Review developers and CI/CD pipelines for untrusted npm package execution.
  4. 4 Check for unauthorized changes to NODE_PATH environment variables.

Hunt Queries

Query Pattern 1
index=windows EventCode=7 Image=*node.exe (ImageLoaded=*\\AppData\\Local\\Temp* OR ImageLoaded=*\\Users\\Public*) | table _time, Computer, ImageLoaded
Query Pattern 2
DeviceImageLoadEvents | where InitiatingProcessFileName =~ 'node.exe' and (FolderPath has 'AppData\\Local\\Temp' or FolderPath has 'Users\\Public') | project Timestamp, DeviceName, FileName, FolderPath

True Positive Confirmation Evidence

Anomalous binary execution
Unexpected child processes
C2 beaconing
!

Benign & False Positive Explanations

Scheduled backup scripts and authorized administrative utilities

Validation Checklist

Correlate timestamps with system activity
Confirm source authenticity

Escalation Criteria

Confirmed unapproved execution with suspicious outbound connections

Traceability & Related Detections