Detects suspicious PKGBUILD with NPM dependency and install script

Hunt Hypothesis

This detection identifies adversaries leveraging malicious PKGBUILD files that execute NPM dependencies and install scripts to establish persistence or deliver payloads within containerized environments. Proactive hunting for this behavior in Azure Sentinel is critical to uncover supply chain attacks where attackers exploit package management mechanisms to silently deploy unauthorized code before traditional signature-based controls trigger alerts.

YARA Rule

rule SUSP_LNX_ARCH_PKGBUILD_NPM_Dependency_Jun26 {
   meta:
      description = "Detects suspicious PKGBUILD with NPM dependency and install script"
      author = "Marius Benthin"
      date = "2026-06-15"
      reference = "https://aur.archlinux.org/cgit/aur.git/commit/?h=hearthstone-linux-gui-bin&id=ecf810ac853e7149abd4e0c793b2517e9737edb8"
      reference2 = "https://aur.archlinux.org/cgit/aur.git/commit/?h=python-django-js-asset&id=af09b1cf1b59"
      hash = "56bed7736d44219215fd912b229c7f765b737db4f6cde256ce264e795310c648"
      hash = "1359814fda7f5ef63f04348439bfb011d7abc0381be6fbb404b04b359d63b61b"
      hash = "3e1f297ab4d261fcad14a865a54d049d75d897d549d03371a5c4bbbc6e10e5cd"
      score = 60
   strings:
      // depends=('npm' or 'bun'
      $sa1 = { (0A | 20) 64 65 70 65 6E 64 73 3D 28 [0-15] (6E 70 6D | 62 75 6E) }

      // install -Dm644 "../*.hook"
      $sb1 = { 69 6E 73 74 61 6C 6C 20 2D 44 6D 36 34 34 20 (22 | 27) [0-100] 2E 68 6F 6F 6B (22 | 27) 0A }
      // install=oracle-bin-deps.install
      $sb2 = { 69 6E 73 74 61 6C 6C 3D [1-50] 2E 69 6E 73 74 61 6C 6C }
   condition:
      filesize < 100KB
      and $sa1
      and 1 of ($sb*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects suspicious PKGBUILD with NPM dependency and install script,” along with suggested filters or exclusions:

DevOps CI/CD Pipeline Execution
- Scenario: Automated build agents (e.g., Jenkins, GitLab Runners) executing npm install within a containerized environment to compile Node.js applications. These builds often generate temporary PKGBUILD files that include standard NPM dependencies and trigger the default install script hooks as part of the artifact creation process.
- Suggested Filter: Exclude events where the source host is identified as a known CI/CD server (e.g., host_name matches jenkins-worker-* or gitlab-runner) AND the user context is a service account (e.g., user equals ci-build-service).
Internal Package Repository Maintenance
- Scenario: The internal IT team using Arch Linux-based systems to update the corporate software repository. When updating Node.js related packages, administrators run scripts that parse PKGBUILD files containing NPM dependencies and execute install scripts to refresh the local cache or push updates to the repo server.
- Suggested Filter: Create an exclusion for processes initiated by known administrative accounts (e.g., admin-repo-updater) running on specific internal subnets (e.g., source_ip in range 10.20.50.x).
Scheduled Developer Environment Provisioning
- Scenario: A nightly scheduled job that provisions new developer workstations or Docker containers with a standardized “Dev-Stack” image. This stack includes Node.js, and the provisioning script parses PKGBUILD definitions to install NPM dependencies via an automated install hook before handing off the machine to end-users.
- Suggested Filter: Exclude events occurring during the