Auto-generated rule - file command.js

Hunt Hypothesis

This detection targets adversaries executing custom JavaScript commands via the command.js file to establish persistence or perform initial reconnaissance within the environment. Proactive hunting for this activity in Azure Sentinel is essential because generic auto-generated rules often lack context-specific logic, requiring manual validation to distinguish legitimate administrative tasks from stealthy malicious execution patterns that could evade standard alerting thresholds.

YARA Rule

rule src_ptheft_command {
	meta:
		description = "Auto-generated rule - file command.js"
		author = "Pasquale Stirparo"
		reference = "not set"
		date = "2015-10-08"
		hash = "49c0e5400068924ff87729d9e1fece19acbfbd628d085f8df47b21519051b7f3"
	strings:
		$s0 = "var lilogo = 'http://content.linkedin.com/etc/designs/linkedin/katy/global/clientlibs/img/logo.png';" fullword wide ascii /* score: '38.00' */
		$s1 = "dark=document.getElementById('darkenScreenObject'); " fullword wide ascii /* score: '21.00' */
		$s2 = "beef.execute(function() {" fullword wide ascii /* score: '21.00' */
		$s3 = "var logo  = 'http://www.youtube.com/yt/brand/media/image/yt-brand-standard-logo-630px.png';" fullword wide ascii /* score: '32.42' */
		$s4 = "description.text('Enter your Apple ID e-mail address and password');" fullword wide ascii /* score: '28.00' */
		$s5 = "sneakydiv.innerHTML= '<div id=\"edge\" '+edgeborder+'><div id=\"window_container\" '+windowborder+ '><div id=\"title_bar\" ' +ti" wide ascii /* score: '28.00' */
		$s6 = "var logo  = 'https://www.yammer.com/favicon.ico';" fullword wide ascii /* score: '27.42' */
		$s7 = "beef.net.send('<%= @command_url %>', <%= @command_id %>, 'answer='+answer);" fullword wide ascii /* score: '26.00' */
		$s8 = "var title = 'Session Timed Out <img src=\"' + lilogo + '\" align=right height=20 width=70 alt=\"LinkedIn\">';" fullword wide ascii /* score: '24.00' */
		$s9 = "var title = 'Session Timed Out <img src=\"' + logo + '\" align=right height=20 width=70 alt=\"YouTube\">';" fullword wide ascii /* score: '24.00' */
		$s10 = "var title = 'Session Timed Out <img src=\"' + logo + '\" align=right height=24 width=24 alt=\"Yammer\">';" fullword wide ascii /* score: '24.00' */
		$s11 = "var logobox = 'style=\"border:4px #84ACDD solid;border-radius:7px;height:45px;width:45px;background:#ffffff\"';" fullword wide ascii /* score: '21.00' */
		$s12 = "sneakydiv.innerHTML= '<br><img src=\\''+imgr+'\\' width=\\'80px\\' height\\'80px\\' /><h2>Your session has timed out!</h2><p>For" wide ascii /* score: '23.00' */
		$s13 = "inner.append(title, description, user,password);" fullword wide ascii /* score: '23.00' */
		$s14 = "sneakydiv.innerHTML= '<div id=\"window_container\" '+windowborder+ '><div id=\"windowmain\" ' +windowmain+ '><div id=\"title_bar" wide ascii /* score: '23.00' */
		$s15 = "sneakydiv.innerHTML= '<div id=\"window_container\" '+windowborder+ '><div id=\"windowmain\" ' +windowmain+ '><div id=\"title_bar" wide ascii /* score: '23.00' */
		$s16 = "answer = document.getElementById('uname').value+':'+document.getElementById('pass').value;" fullword wide ascii /* score: '22.00' */
		$s17 = "password.keydown(function(event) {" fullword wide ascii /* score: '21.01' */
	condition:
		13 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 18 string patterns in its detection logic.

References

• not set
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Auto-generated rule - file command.js” detection rule, including suggested filters and exclusions:

• Scenario: Node.js Deployment via CI/CD Pipeline

  • Context: Automated build agents (e.g., Jenkins, GitHub Actions, or Azure DevOps) frequently create or update command.js files within the application root during deployment phases to handle runtime logic.
  • Filter/Exclusion: Exclude file creation/modification events where the source process is a known CI/CD runner (e.g., jenkins-agent.exe, github-actions-runner.exe) and the user context is a service account named svc-deploy or ci-bot.

• Scenario: Scheduled Maintenance Script Execution

  • Context: A nightly maintenance task managed by Windows Task Scheduler executes a custom script that generates a temporary command.js file in a specific logs directory to log audit trails before cleanup.
  • Filter/Exclusion: Filter out events where the parent process is svchost.exe (specifically the “TaskScheduler” service) and the full file path matches the pattern C:\ProgramData\Maintenance\Logs\command.js.

• Scenario: Endpoint Security Agent Self-Update

  • Context: The enterprise EDR solution (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) periodically writes configuration or policy files named command.js within its own installation directory during a background update cycle.
  • Filter/Exclusion: Exclude events where the parent process is the specific security agent executable (e.g., C:\Program Files\CrowdStrike\FalconSensor\csfalcon.exe) and the file path resides strictly within the vendor’s installation folder (C:\Program Files\CrowdStrike\...).

• **Scenario: Admin Manual Scripting