Listen to this Post
Introduction:
The recent discovery of malicious NPM packages, including typosquatted versions of popular libraries like `debug` and chalk, has sent shockwaves through the development community. These supply chain attacks can lead to data exfiltration, credential theft, and full system compromise, making rapid detection critical. This article provides security professionals with the advanced Kusto Query Language (KQL) techniques needed to proactively hunt for and identify these threats within their Microsoft Sentinel environments.
Learning Objectives:
- Understand the key data sources and event schemas required to investigate NPM package installations.
- Construct precise KQL queries to detect both known-malicious and suspicious NPM packages.
- Learn advanced hunting techniques to identify anomalous installation patterns and potential lateral movement.
You Should Know:
1. The Core Hunting Query
The primary query focuses on the `DeviceProcessEvents` table, which logs process creation events, to catch the moment `npm install` or `node` executes.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "npm.exe" or FileName =~ "node.exe"
| where ProcessCommandLine has_all ("install", "debug") and ProcessCommandLine has_any ("--global", "-g")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| extend PackageName = extract(@"install\s+([^\s]+)", 1, ProcessCommandLine)
Step-by-step guide:
This query scans the last week of process events. It first filters for events where the process name is either `npm.exe` or node.exe. It then narrows down the results to commands that include both “install” and a package name like “debug”, specifically looking for global installations (-g or --global), which are often more impactful. The `project` operator selects relevant columns for the investigation, and the `extract` function uses a regular expression to isolate the package name from the command line for clearer reporting.
2. Expanding the Search to Known Malicious Packages
Once a malicious package is identified (e.g., chalked, debug-vision), you can create a denylist hunt.
let KnownMaliciousPackages = dynamic(["chalked", "debug-vision", "npm-check-imports"]); DeviceProcessEvents | where Timestamp > ago(1d) | where FileName =~ "npm.exe" | where ProcessCommandLine has "install" | where ProcessCommandLine has_any (KnownMaliciousPackages) | project Timestamp, DeviceName, AccountName, ProcessCommandLine
Step-by-step guide:
This query uses the `dynamic` operator to create a list of known malicious package names. It then searches for any `npm install` command lines that contain any of those names. This is a crucial reactive hunting method when threat intelligence feeds release new indicators of compromise (IOCs). Update the `KnownMaliciousPackages` list as new threats are discovered.
3. Hunting for Suspicious Network Connections Post-Installation
A key goal of malicious packages is to beacon out to a command and control (C2) server. This query joins process and network events.
DeviceProcessEvents | where Timestamp > ago(24h) | where FileName =~ "node.exe" | where ProcessCommandLine has "debug-vision" | join kind=inner ( DeviceNetworkEvents | where Timestamp > ago(24h) | where ActionType == "ConnectionSuccess" ) on DeviceId, InitiatingProcessId | project Timestamp, DeviceName, ProcessCommandLine, RemoteUrl, RemotePort
Step-by-step guide:
This query first finds any `node.exe` processes running a known malicious package. It then performs an inner join with the `DeviceNetworkEvents` table on both `DeviceId` and InitiatingProcessId. This links the specific node process to any successful network connections it established, revealing the C2 server’s URL and port.
4. Detecting Package Installation via Scripts and Automation
Attackers may use scripts to deploy malicious packages. This hunt looks for script hosts executing NPM commands.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe")
| where ProcessCommandLine contains "npm" and ProcessCommandLine contains "install"
| project Timestamp, DeviceName, AccountName, InitiatingProcessParentFileName, ProcessCommandLine
Step-by-step guide:
This query is vital for detecting indirect execution. It filters for common script hosts (PowerShell, CMD, etc.) and checks their command lines for NPM installation commands. The `InitiatingProcessParentFileName` can help you trace the activity back to a parent process, such as a scheduled task or a downloaded script, revealing the initial attack vector.
5. Baselining Normal Activity and Finding Anomalies
To find unknown threats, you must first understand normal behavior. This query establishes a baseline of which accounts typically install global packages.
DeviceProcessEvents | where Timestamp > ago(30d) | where FileName =~ "npm.exe" | where ProcessCommandLine has "--global" or ProcessCommandLine has "-g" | summarize GlobalInstallCount = count() by AccountName, bin(Timestamp, 1d) | where GlobalInstallCount > 5
Step-by-step guide:
This query aggregates data over 30 days, counting the number of global installations per user account per day. The results show which users are regularly performing these actions. An alert could be built to trigger when a user account that never performs global installations (e.g., a service account) suddenly does so, indicating a potential compromise.
What Undercode Say:
- The speed of detection is paramount. The provided KQL queries shift the response timeline from days to minutes, allowing analysts to contain threats before significant damage occurs.
- Supply chain attacks are a persistent and evolving threat. Moving beyond simple IOC matching to behavioral analysis, like detecting anomalous installs, is no longer optional but a necessity for a mature security program.
The sophistication of NPM supply chain attacks will only increase. We predict a move towards more “low-and-slow” techniques, where malicious payloads remain dormant or exhibit minimal network traffic to avoid detection by standard IOC-based hunts. The future of hunting these threats lies in advanced anomaly detection and machine learning models that analyze vast amounts of process execution and network data to identify subtle deviations from baseline behavior, even before a package is publicly identified as malicious. Proactive hunting, as demonstrated with these KQL queries, is the foundational step towards building that advanced capability.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Mehmetergene Npm – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
