Detects suspicious JavaScript which exits silently and checks operating system

Hunt Hypothesis

This rule detects adversary behavior where malicious scripts perform environment reconnaissance by querying OS details while suppressing output to evade standard logging visibility. Proactive hunting for this pattern in Azure Sentinel is critical because silent execution combined with OS checks often indicates an early-stage post-exploitation phase, allowing the SOC team to identify stealthy threats before they establish persistence or exfiltrate data.

YARA Rule

rule SUSP_JS_NPM_SetupScript_Nov25 {
   meta:
      description = "Detects suspicious JavaScript which exits silently and checks operating system"
      author = "Marius Benthin"
      date = "2025-11-24"
      modified = "2025-12-15"
      reference = "https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains"
      hash = "a3894003ad1d293ba96d77881ccd2071446dc3f65f434669b49b3da92421901a"
      score = 70
      id = "2d102efd-681a-5af1-b4fe-3489e5e7f8f2"
   strings:
      $sa1 = "require('child_process')"
      $sa2 = "process.platform ==="

      $sb1 = "().catch((e"
      $sb2 = "process.exit(0)"
   condition:
      filesize < 100KB
      and all of ($sa*)
      and $sb1 in (filesize - 50..filesize)
      and $sb2 in (filesize - 30..filesize)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects suspicious JavaScript which exits silently and checks operating system,” along with recommended filters or exclusions:

Scenario 1: Automated Patch Management Scans
- Context: Enterprise tools like Microsoft SCCM (Configuration Manager) or Ivanti Neurons often deploy small .js scripts to inventory hardware, verify OS version compatibility before patching, and then terminate immediately without user interaction. These scripts frequently query System.Environment.OSVersion and exit with code 0.
- Filter/Exclusion: Add an exclusion for the specific file path of the SCCM client agent (e.g., C:\Program Files\Microsoft Configuration Manager\ccmexec.exe) or filter by the parent process name ccmsetup.exe. Alternatively, exclude scripts running under the “System” account that have a known hash.
Scenario 2: Scheduled Compliance Auditing Tasks
- Context: Security compliance tools such as Trend Micro Apex One, Symantec Endpoint Protection, or custom PowerShell/Node.js agents run nightly scheduled jobs to verify OS integrity and configuration baselines. These jobs often spawn a transient JavaScript process that checks the OS build number, logs the result, and exits silently via process.exit(0).
- Filter/Exclusion: Create a filter based on the parent process being a known service (e.g., TaskScheduler.exe or smc.exe) and restrict the rule to trigger only if the script is not running during standard business hours (9 AM – 5 PM) unless explicitly flagged as an exception.
Scenario 3: Browser-Based Kiosk Mode Initialization
- Context: In shared workspaces or digital signage, browsers like Google Chrome or Microsoft Edge in kiosk mode often execute startup scripts