Detects suspicious JavaScript dropper used in plain-crypto-js supply chain attacks

Hunt Hypothesis

This hunt targets adversaries leveraging malicious JavaScript droppers to compromise software supply chains, specifically mimicking the behavior observed in recent plain-crypto-js incidents where attackers inject code to establish persistence and execute secondary payloads. Proactively hunting for this pattern within Azure Sentinel is critical because it enables the early identification of stealthy supply chain compromises that traditional signature-based detections might miss, allowing the SOC team to isolate affected resources before lateral movement occurs.

YARA Rule

rule SUSP_JS_Dropper_Mar26 {
   meta:
      description = "Detects suspicious JavaScript dropper used in plain-crypto-js supply chain attacks"
      author = "Marius Benthin"
      date = "2026-03-31"
      reference = "https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan"
      hash = "e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09"
      score = 70
      id = "456a52c2-9cbf-572f-9a5b-b8d74183e3f4"
   strings:
      $sa1 = "Buffer.from("
      $sa2 = "FileSync("
      $sa3 = ".replaceAll("

      $sb1 = ".arch()"
      $sb2 = ".platform()"
      $sb3 = ".release()"
      $sb4 = ".type()"
   condition:
      filesize < 10KB
      and all of ($sa*)
      and 2 of ($sb*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

References

• https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Detects suspicious JavaScript dropper used in plain-crypto-js supply chain attacks” rule, along with recommended filters and exclusions:

• Automated CI/CD Pipeline Execution

  • Scenario: Continuous Integration platforms (e.g., Jenkins, GitHub Actions, or GitLab Runners) frequently execute JavaScript build scripts to process dependencies. These agents often download crypto-js packages from npm registries and compile them using Node.js, triggering the dropper logic as part of a standard deployment workflow rather than an attack.
  • Filter/Exclusion: Exclude processes running under specific service accounts (e.g., svc-jenkins, github-actions-runner) or restrict detection to non-build environments by filtering out network traffic originating from internal CI subnets (e.g., 10.20.x.x).

• Scheduled Office Add-in Updates

  • Scenario: Enterprise-wide scheduled tasks running during off-hours often trigger updates for productivity suites like Microsoft 365 Apps. Specifically, the “Office JavaScript API” or add-ins utilizing cryptographic libraries may download and instantiate crypto-js modules to refresh local caches, mimicking the behavior of a supply chain dropper.
  • Filter/Exclusion: Create an exclusion rule for process paths containing \Microsoft Office\root\Office16\ or filter by specific scheduled task names (e.g., “O365UpdateTask”) that run between 02:00 and 04:00 local time.

• DevOps Dependency Scanning Tools

  • Scenario: Security tools such as Snyk, Black Duck, or OWASP Dependency-Check actively scan code repositories for vulnerabilities. These tools programmatically instantiate JavaScript environments to analyze package integrity, often downloading and executing crypto-js components to