IronWorm — Rust-Built npm Supply-Chain Worm

Looks for: npm/node spawning chmod/exec of a binary under node_modules (esp. tools/setup). Accomplishes: catches the ELF drop+run. FP: some native modules ship binaries — verify path/size.

// HUNT: IronWorm install hook drops/executes a native ELF (tools/setup)
// MITRE: T1195.002, T1106 | CONF: high  FP: low-med  COST: low
// FP NOTES: some native modules ship binaries; flag tools/setup + chmod + exec from node_modules
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(npm|node|yarn|pnpm)$/i
| (CommandLine=/node_modules\/.+\/tools\/setup/i or (FileName=/^chmod$/i and CommandLine=/node_modules\/.+(setup|bin)/i))
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

Looks for: an ELF/Mach-O written to a tools/ path inside node_modules during install. Accomplishes: catches the implant drop pre-execution.

// HUNT: IronWorm native implant written into node_modules
// MITRE: T1105 | CONF: high  FP: low-med  COST: low
// TUNING: correlate to Q1; ~976KB UPX-packed; tools/setup path
#event_simpleName=/ELFFileWritten|NewExecutableWritten/
| TargetFileName=/node_modules\/.+\/tools\/(setup|bin)/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName, SHA256HashData], limit=200)

Looks for: a non-system process loading an eBPF program (BPF_PROG_LOAD) or invoking bpf(). Accomplishes: the rootkit load. FP: observability/security agents use eBPF — allow-list them. Requires Linux sensor eBPF/syscall telemetry.

// HUNT: IronWorm eBPF rootkit load (non-system process)
// MITRE: T1014, T1562.001 | CONF: high  FP: low-med  COST: med
// REQUIRES: Linux sensor eBPF/syscall telemetry
// TUNING: allow-list observability/security agents
#event_simpleName=/BpfProgramLoad|SyscallBpf|KernelModuleLoad/
| ImageFileName!=/\/(usr\/(s)?bin|opt\/(falcon|datadog|sysdig|cilium))\//i
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine], limit=200)

Looks for: a single process opening many credential files (.aws, .npmrc, kube config, Vault, Exodus wallet). Accomplishes: the harvest stage. FP: dev tooling reads some — flag breadth + a node_modules-spawned parent. Requires file-access telemetry.

// HUNT: IronWorm credential/secret harvesting (broad cred-file reads)
// MITRE: T1552.001, T1552.005, T1539 | CONF: medium  FP: medium  COST: med
// REQUIRES: file-access telemetry
// TUNING: flag breadth + a node_modules-derived parent
#event_simpleName=/FileOpen|ProcessFileOpen|OsfmFileOpen/
| TargetFileName=/(\.aws\/credentials|\.npmrc|\.config\/gcloud|kube\/config|\.vault-token|\.docker\/config|Exodus\/exodus\.wallet|\.ssh\/id_)/i
| groupBy([aid, ImageFileName], function=[count(field=TargetFileName, distinct=true, as=files)])
| files>=4
| sort(files, order=desc)

Looks for: DNS/connections to temp.sh or Tor entry-node patterns from a dev host. Accomplishes: the exfil channel. FP: low for temp.sh on a dev host; Tor requires an entry-node feed.

// HUNT: IronWorm exfil (temp.sh fallback / Tor)
// MITRE: T1567, T1090.003 | CONF: medium  FP: low-med  COST: low
// TUNING: enrich with Tor entry-node feed; temp.sh from a dev host is suspicious
#event_simpleName=DnsRequest
| DomainName=/(^|\.)(temp\.sh)$/i
| table([@timestamp, ComputerName, ContextBaseFileName, DomainName], limit=200)

Looks for: the dropped implant / node contacting registry.npmjs.org outside a sanctioned publish pipeline. Accomplishes: worm re-publish. FP: legit dev tooling — correlate with Q1–Q3 + non-CI host.

// HUNT: IronWorm self-propagation (publish to npm outside a pipeline)
// MITRE: T1195.002 | CONF: medium  FP: medium  COST: med
// TUNING: exclude sanctioned publish runners; correlate to Q1-Q3
#event_simpleName=DnsRequest
| DomainName=/(^|\.)registry\.npmjs\.org$/i
| ContextBaseFileName=/^(node|setup|npm)$/i
| table([@timestamp, ComputerName, ContextBaseFileName, DomainName], limit=200)