Template -- Compromise Software Supply Chain (CI/package-manager LOLBin spawn)

SIGMA detection rule by WinstonRedGuard -- sigma plugin canonical templates · Unknown

Canonical sigma detection template for MITRE ATT&CK T1195.002 (Compromise Software Supply Chain (CI/package-manager LOLBin spawn)). Synthetic exemplar from the WinstonRedGuard threat-intel corpus -- no actor binding; review and bind to your environment before deployment.

title: Template -- Compromise Software Supply Chain (CI/package-manager LOLBin spawn)
id: 95bd227d-bc9c-5327-a115-41dedd14f12f
status: experimental
description: Canonical sigma detection template for MITRE ATT&CK T1195.002 (Compromise Software Supply Chain (CI/package-manager
  LOLBin spawn)). Synthetic exemplar from the WinstonRedGuard threat-intel corpus -- no actor binding; review and bind to
  your environment before deployment.
references:
- https://attack.mitre.org/techniques/T1195/002/
author: WinstonRedGuard -- sigma plugin canonical templates
date: '2026-05-21'
logsource:
  category: process_creation
  product: windows
detection:
  selection_ci_parent:
    ParentImage|endswith:
    - \npm.cmd
    - \npm
    - \npm-cli.js
    - \yarn.cmd
    - \node.exe
  selection_lolbin_child:
    Image|endswith:
    - \certutil.exe
    - \bitsadmin.exe
    - \curl.exe
    - \powershell.exe
    - \wscript.exe
    - \mshta.exe
  condition: selection_ci_parent and selection_lolbin_child
falsepositives:
- node.exe spawning powershell.exe, which npm lifecycle scripts, node-gyp builds and cross-platform tooling do routinely on Windows
- curl.exe, which ships with Windows and is a normal way for a postinstall script to fetch a platform-specific binary
- Build agents, where the parent list matches nearly every job; this rule earns its keep on developer endpoints and servers rather than on CI runners
level: medium
tags:
- attack.t1195.002
- wrg.template
- wrg.tactic.initial_access

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

63c16640-c93a-4587-9c7c-cfd3fb822a55

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion