Detects suspicious .SRCINFO with NPM dependency and install script

Hunt Hypothesis

This hunt targets adversaries who leverage malicious .SRCINFO files containing NPM dependencies to execute hidden install scripts that can compromise build pipelines or introduce supply chain vulnerabilities. Proactively hunting for this behavior in Azure Sentinel is critical because these artifacts often bypass standard file integrity checks and can serve as a stealthy entry point for post-exploitation activities within containerized or Node.js environments.

YARA Rule

rule SUSP_LNX_ARCH_SRCINFO_NPM_Dependency_Jun26 {
   meta:
      description = "Detects suspicious .SRCINFO with NPM dependency and install script"
      author = "Marius Benthin"
      date = "2026-06-15"
      reference = "https://aur.archlinux.org/cgit/aur.git/commit/?h=hearthstone-linux-gui-bin&id=ecf810ac853e7149abd4e0c793b2517e9737edb8"
      hash = "2ee28d5866fdb46e439678ad92729b1cd71d2d871135d8d56a27cf6a6b49e649"
      score = 60
   strings:
      $s1 = "depends = npm\n"
      // install = python-pymilvus-deps.install
      $s2 = { 69 6E 73 74 61 6C 6C 20 3D 20 [1-50] 2E 69 6E 73 74 61 6C 6C }
   condition:
      filesize < 5KB
      and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects suspicious .SRCINFO with NPM dependency and install script,” including suggested filters or exclusions:

Automated CI/CD Pipeline Execution
- Scenario: The organization’s internal CI/CD platform (e.g., GitHub Actions, GitLab CI, or Jenkins) automatically clones a repository containing an AUR-style .SRCINFO file to build a Node.js application. During the build phase, the pipeline executes npm install, which triggers the rule because the script parses dependencies defined in the .SRCINFO.
- Filter/Exclusion: Exclude processes running under specific service accounts (e.g., svc-github-runner, jenkins-agent) or restrict detection to non-CI network segments. Add a filter for process names matching node.exe spawned by github-actions-runner.exe or java.exe (Jenkins).
Developer Local Build Environments
- Scenario: A software engineer on the R&D team is locally testing a new internal microservice that utilizes an .SRCINFO configuration for dependency management. They run a local build command (make install or a custom PowerShell script) which invokes npm to resolve dependencies listed in the file, triggering the alert during their development workflow.
- Filter/Exclusion: Create an exclusion based on user groups (e.g., exclude users in the “R&D-Developers” AD group) or restrict the rule to only trigger during non-business hours if this specific build pattern is known to occur primarily at night. Alternatively, whitelist the specific file path C:\DevWorkspace\InternalServices\*.SRCINFO.
Scheduled Backup and Archive Jobs
- Scenario: A nightly scheduled job (e.g., using Veeam or a custom PowerShell script) archives source code repositories to an on-premise NAS.