Jonhnathan
121 lines
4.1 KiB
TOML
121 lines
4.1 KiB
TOML
[metadata]
|
|
creation_date = "2026/03/19"
|
|
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "system", "crowdstrike"]
|
|
maturity = "production"
|
|
updated_date = "2026/04/07"
|
|
|
|
[rule]
|
|
author = ["Elastic"]
|
|
description = """
|
|
Detects execution of JavaScript via Deno with suspicious command-line patterns (base64, eval, http, or import in a
|
|
javascript context). Adversaries may abuse Deno to run malicious JavaScript for execution or staging.
|
|
"""
|
|
from = "now-9m"
|
|
index = [
|
|
"endgame-*",
|
|
"logs-crowdstrike.fdr*",
|
|
"logs-endpoint.events.process-*",
|
|
"logs-m365_defender.event-*",
|
|
"logs-sentinel_one_cloud_funnel.*",
|
|
"logs-system.security*",
|
|
"logs-windows.sysmon_operational-*",
|
|
"winlogbeat-*",
|
|
]
|
|
language = "eql"
|
|
license = "Elastic License v2"
|
|
name = "Suspicious JavaScript Execution via Deno"
|
|
note = """## Triage and analysis
|
|
|
|
### Investigating Suspicious JavaScript Execution via Deno
|
|
|
|
Deno is a legitimate JavaScript/TypeScript runtime. This rule fires when a Deno process (identified by name, PE original filename, or code signer "Deno Land Inc.") is started with a command line matching suspicious patterns: javascript with base64, eval(, http, or javascript import. Such patterns are commonly used to run inline or remote scripts and can indicate abuse.
|
|
|
|
### Possible investigation steps
|
|
|
|
- Review process.command_line and process.args to see the exact script or URL being executed.
|
|
- Identify the parent process and how Deno was launched (user, script, terminal, or other tool).
|
|
- Check whether Deno is approved on the host; if not, treat as potential unauthorized software execution.
|
|
- Correlate with file creation or network events around the same time (downloads, script drops).
|
|
|
|
### False positive analysis
|
|
|
|
- Legitimate development or automation that runs Deno with eval, http imports, or base64-encoded snippets may trigger; allowlist by host or command-line pattern where appropriate.
|
|
|
|
### Response and remediation
|
|
|
|
- If abuse is confirmed: contain the host, terminate the Deno process, and remove or block Deno if not authorized; investigate how the script was delivered and scope for similar activity.
|
|
"""
|
|
references = [
|
|
"https://reliaquest.com/blog/threat-spotlight-casting-a-wider-net-clickfix-deno-and-leaknets-scaling-threat",
|
|
"https://deno.com/"
|
|
]
|
|
risk_score = 73
|
|
rule_id = "ff18d24b-2ba6-4691-a17f-75c4380d0965"
|
|
severity = "high"
|
|
tags = [
|
|
"Domain: Endpoint",
|
|
"OS: Windows",
|
|
"Use Case: Threat Detection",
|
|
"Tactic: Execution",
|
|
"Resources: Investigation Guide",
|
|
"Data Source: Elastic Defend",
|
|
"Data Source: Sysmon",
|
|
"Data Source: SentinelOne",
|
|
"Data Source: Microsoft Defender XDR",
|
|
"Data Source: Crowdstrike",
|
|
"Data Source: Elastic Endgame",
|
|
"Data Source: Windows Security Event Logs"
|
|
]
|
|
timestamp_override = "event.ingested"
|
|
type = "eql"
|
|
|
|
query = '''
|
|
process where host.os.type == "windows" and event.type == "start" and
|
|
(process.name : "deno.exe" or ?process.pe.original_file_name == "deno.exe" or ?process.code_signature.subject_name == "Deno Land Inc.") and
|
|
process.command_line : ("*javascript*base64*", "*eval(*", "*http*", "*javascript*import*")
|
|
'''
|
|
|
|
[[rule.threat]]
|
|
framework = "MITRE ATT&CK"
|
|
|
|
[[rule.threat.technique]]
|
|
id = "T1059"
|
|
name = "Command and Scripting Interpreter"
|
|
reference = "https://attack.mitre.org/techniques/T1059/"
|
|
|
|
[[rule.threat.technique.subtechnique]]
|
|
id = "T1059.007"
|
|
name = "JavaScript"
|
|
reference = "https://attack.mitre.org/techniques/T1059/007/"
|
|
|
|
[rule.threat.tactic]
|
|
id = "TA0002"
|
|
name = "Execution"
|
|
reference = "https://attack.mitre.org/tactics/TA0002/"
|
|
|
|
[[rule.threat]]
|
|
framework = "MITRE ATT&CK"
|
|
|
|
[[rule.threat.technique]]
|
|
id = "T1105"
|
|
name = "Ingress Tool Transfer"
|
|
reference = "https://attack.mitre.org/techniques/T1105/"
|
|
|
|
[rule.threat.tactic]
|
|
id = "TA0011"
|
|
name = "Command and Control"
|
|
reference = "https://attack.mitre.org/tactics/TA0011/"
|
|
|
|
[[rule.threat]]
|
|
framework = "MITRE ATT&CK"
|
|
|
|
[[rule.threat.technique]]
|
|
id = "T1027"
|
|
name = "Obfuscated Files or Information"
|
|
reference = "https://attack.mitre.org/techniques/T1027/"
|
|
|
|
[rule.threat.tactic]
|
|
id = "TA0005"
|
|
name = "Defense Evasion"
|
|
reference = "https://attack.mitre.org/tactics/TA0005/"
|