Detects malicious component of node package named Etoroloro

Hunt Hypothesis

This hunt hypothesis targets adversaries who compromise Node.js environments by injecting a malicious dependency named “Etoroloro” to establish persistence and execute arbitrary code within the application supply chain. The SOC team should proactively hunt for this indicator in Azure Sentinel to identify early-stage supply chain attacks that could lead to data exfiltration or lateral movement before they escalate into critical incidents.

YARA Rule

rule MAL_Etoroloro_Malicious_NodePackage_Dec25 {
   meta:
      description = "Detects malicious component of node package named Etoroloro"
      reference = "Internal Research"
      author = "Pezier Pierre-Henri"
      date = "2025-12-12"
      score = 80
      hash = "f08c5b748c91dd45fd73c5e85920f656e361d94b869e2147410b2b528c6ae78f"
      id = "4c271502-68c6-5d20-85ea-c7f7628e417a"
   strings:
      $s1 = "DLLSideload."
      $s2 = "Failed to expand path:" wide
      $op1 = {
         41 0f af c0           // imul    eax, r8d
         48 8d 52 01           // lea     rdx, [rdx+1]
         0f b6 c9              // movzx   ecx, cl
         45 69 c0 35 d4 04 00  // imul    r8d, 4D435h
         03 c1                 // add     eax, ecx
         0f b6 0a              // movzx   ecx, byte ptr [rdx]
         84 c9                 // test    cl, cl
         75 e5                 // jnz     short loc_1800022C0
      }
   condition:
      uint16(0) == 0x5a4d
      and (all of ($s*) or $op1)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects malicious component of node package named Etoroloro” rule, along with suggested filters or exclusions:

• CI/CD Pipeline Artifact Caching

  • Scenario: The enterprise CI/CD platform (e.g., Jenkins, GitLab CI, or GitHub Actions) caches node_modules dependencies in a shared volume. A legacy build agent pulls the Etoroloro package as part of a standard dependency tree for an internal microservice, triggering the rule during the automated build phase rather than a user-initiated deployment.
  • Filter/Exclusion: Exclude alerts where the source host is identified as a CI runner (e.g., hostname contains -jenkins-agent- or IP range 10.20.45.0/24) and the process name is node running under the service account svc-build-runner.

• Scheduled Dependency Audit Job

  • Scenario: A nightly scheduled task (e.g., via Windows Task Scheduler or Cron) runs a security scanning tool like npm audit or Snyk CLI against the code repository. This job iterates through all installed packages, including Etoroloro, to generate compliance reports, causing the detection engine to flag the package scan as an active threat event.
  • Filter/Exclusion: Create a time-based exclusion window (e.g., 02:00–04:00 UTC) for processes named snyk-cli or npm-audit-runner executing on the build server, provided no new deployment occurred in that window.

• Legacy Internal Dashboard Maintenance

  • Scenario: The internal IT dashboard team performs a routine maintenance update on an older Node.js application (e.g., “HR-Portal-v1”) which relies on `Etorolor