New Agent Skills Installation Attempt Via Node.EXE

Status: experimental
Severity: medium
Log source: category process_creation, product windows
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
Source: github.com/SigmaHQ/sigma

Detects the attempt to install new skills for AI agents using the "npx skills" command. Agent skills enhance AI agents with new capabilities, but attackers may abuse this mechanism to inject malicious commands executed by the agent on behalf of the user. The "npx skills" command can install skills for various agents (e.g., Claude Code, Cursor, and others). Analysts should review any installed skills to verify their legitimacy. Note: Tune this rule based on whether AI agent tooling is allowed in your environment. In environments where such tooling is authorized, this detection may reflect normal activity and the alert level should be adjusted accordingly. In environments where AI agent tooling is not permitted, this activity is likely suspicious and may require immediate investigation.

Known false positives

This rule will be triggered when a new agent skill is installed regardless if it is benign or malicious.
High false positive rate expected in environments where AI agent tooling is authorized and commonly used.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059.007` Command and Scripting Interpreter: JavaScript

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: New Agent Skills Installation Attempt Via Node.EXE
id: afa71271-6a97-4e47-810f-83120fb1a4ce
status: experimental
description: |
    Detects the attempt to install new skills for AI agents using the "npx skills" command.
    Agent skills enhance AI agents with new capabilities, but attackers may abuse this mechanism to inject malicious commands executed by the agent on behalf of the user.
    The "npx skills" command can install skills for various agents (e.g., Claude Code, Cursor, and others).
    Analysts should review any installed skills to verify their legitimacy.
    Note: Tune this rule based on whether AI agent tooling is allowed in your environment.
    In environments where such tooling is authorized, this detection may reflect normal activity and the alert level should be adjusted accordingly.
    In environments where AI agent tooling is not permitted, this activity is likely suspicious and may require immediate investigation.
references:
    - https://blog.lukaszolejnik.com/supply-chain-risk-of-agentic-ai-infecting-infrastructures-via-skill-worms/
    - https://github.com/vercel-labs/skills/blob/1f7fbc8d0e49c4e0601d364696bd1bdd15e80967/README.md
    - https://opensourcemalware.com/blog/clawdbot-skills-ganked-your-crypto
    - https://promptintel.novahunting.ai/molt
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
date: 2026-02-03
tags:
    - attack.execution
    - attack.t1059.007
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith: '\node.exe'
        - OriginalFileName: 'node.exe'
    selection_cli:
        CommandLine|contains|all:
            - 'npx-cli.js'
            - 'skills '
            - ' add '
    condition: all of selection_*
falsepositives:
    - This rule will be triggered when a new agent skill is installed regardless if it is benign or malicious.
    - High false positive rate expected in environments where AI agent tooling is authorized and commonly used.
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_node_new_agent_skills_installed/info.yml

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\node.exe'
    - OriginalFileName: 'node.exe'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains|all:
        - 'npx-cli.js'
        - 'skills '
        - ' add '

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`add` corpus 15 (sigma 13, splunk 1, chronicle 1) `npx-cli.js` `skills`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\node.exe` corpus 6 (sigma 6)	`field:"Image" kind:ends_with value:"\node.exe"`
`OriginalFileName`	eq	`node.exe` corpus 7 (elastic 4, sigma 3)	`field:"OriginalFileName" kind:eq value:"node.exe"`