detection.wiki

Detection rules › Sigma

Suspicious Deno File Written from Remote Source

Status
experimental
Severity
low
Log source
product windows, category file_event
Author
Josh Nickels, Michael Taggart
Source
github.com/SigmaHQ/sigma

Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious DLL. This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1059.007 Command and Scripting Interpreter: JavaScript, T1204 User Execution
Command & ControlT1105 Ingress Tool Transfer

Event coverage

ProviderEventTitle
SysmonEvent ID 11FileCreate

Rule body yaml

title: Suspicious Deno File Written from Remote Source
id: 6c0ce3b6-85e2-49d4-9c3f-6e008ce9796e
status: experimental
description: |
    Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious DLL.
    This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.
references:
    - https://taggart-tech.com/evildeno/
author: Josh Nickels, Michael Taggart
date: 2025-05-22
tags:
    - attack.execution
    - attack.t1204
    - attack.t1059.007
    - attack.command-and-control
    - attack.t1105
logsource:
    category: file_event
    product: windows
detection:
    selection_path:
        TargetFilename|contains:
            - '\deno\gen\'
            - '\deno\remote\https\'
        TargetFilename|contains|all:
            - ':\Users\'
            - '\AppData\'
    condition: selection_path
falsepositives:
    - Legitimate usage of deno to request a file or bring a DLL to a host
level: low

Stages and Predicates

Stage 0: condition

selection_path

Stage 1: selection_path

selection_path:
    TargetFilename|contains:
        - '\deno\gen\'
        - '\deno\remote\https\'
    TargetFilename|contains|all:
        - ':\Users\'
        - '\AppData\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
TargetFilenamematch
  • :\Users\ corpus 4 (sigma 4)
  • \AppData\ corpus 4 (sigma 4)
  • \deno\gen\
  • \deno\remote\https\