Node Script Execution and Immediate Deletion

[rule]
description = """
Detects Node.js executing a JavaScript file followed by immediate deletion of that script. This anti-forensics pattern
is used to execute malicious logic and then destroy the evidence, making post-incident inspection difficult. The tight
timing window between execution and deletion distinguishes this from normal cleanup or build processes.
"""
id = "1059825f-8f64-4b69-a398-2a54003d1946"
license = "Elastic License v2"
name = "Node Script Execution and Immediate Deletion"
os_list = ["linux", "windows"]
reference = ["https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections"]
version = "1.0.2"

query = '''
sequence by process.entity_id with maxspan=10s
  [process where event.type == "start" and event.action in ("exec", "start") and
    process.name in ("node", "node.exe") and process.args_count <= 2 and
    process.args like~ (
      "/tmp/*.js", "/private/tmp/*.js",
      "/var/tmp/*.js", "/private/var/tmp/*.js",
      "/Users/Shared/*.js",
      "/var/folders/*/T/*.js", "/private/var/folders/*/T/*.js",
      "/Users/*/Library/Caches/*.js",
      "/dev/shm/*.js",
      "?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Temp\\\\*.js",
      "?:\\\\Windows\\\\Temp\\\\*.js",
      "?:\\\\ProgramData\\\\Temp\\\\*.js"
    )] as event0
  [file where event.action == "deletion" and file.extension : "js" and
   stringcontains~(event0.process.command_line, file.name) and
   not (
     process.executable like "/actions-runner/externals/node24/bin/node" and
     file.path like (
       "/tmp/github-runner-*/index.js",
       "/root/setup-pnpm/node_modules/.pnpm/pnpm@*/node_modules/pnpm/dist/node_modules/env-paths/index.js"
     )
   )]
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1070"
name = "Indicator Removal"
reference = "https://attack.mitre.org/techniques/T1070/"
[[threat.technique.subtechnique]]
id = "T1070.004"
name = "File Deletion"
reference = "https://attack.mitre.org/techniques/T1070/004/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.16.0"