Package manager lifecycle hook spawning a script or download utility

Siemphony@siemphonylowT1195.001unverifiedPlaybook · Destructive impact

Flags a package manager or build tool creating a child process that is a script interpreter or a download utility — the "first run of newly written components triggers scripts (preinstall/postinstall), shell/PowerShell spawning" step of MITRE's chain. Two shapes of manager and two shapes of child are matched, because on Windows the canonical case runs through ComSpec rather than directly. The manager arms are the real executables (node.exe, python.exe, pip.exe, nuget.exe, dotnet.exe, choco.exe, cargo.exe) and, separately, cmd.exe whose own command line names a package-manager shim: npm.cmd, npx.cmd, yarn.cmd, pnpm.cmd, mvn.cmd, gradle.bat, npm-cli.js, node_modules or setup.py. Those shim names are matched in ParentCommandLine and never in ParentImage — a `.cmd` or `.bat` is not a process image, so `ParentImage|endswith: '\npm.cmd'` would render in every backend and match nothing. The child arms are an interpreter or downloader spawned directly, or cmd.exe spawned with one of those named on its command line, which is the lineage npm and yarn lifecycle hooks actually take (node.exe runs npm-cli.js, npm-cli.js runs the hook through `cmd /d /s /c`, and the payload is the grandchild). pip breaks the same way, with pip.exe spawning python.exe to run setup.py. The full analytic is a correlation — manager writes files, the new component runs, then egress to a non-approved registry within a 90-minute window — and Sigma can express neither a sequence nor a time window, so the egress half is absent. Without it there is nothing in the event saying the package was untrusted: this observable is a build tool spawning an interpreter, which is supply-chain-shaped only by context, and an analyst should expect to triage it as execution rather than as evidence of initial access. Prerequisite: Sysmon EventID 1 is not present in a default install, and the cmd.exe arms need command-line capture on both the process and its parent. UNVERIFIED — derived from MITRE ATT&CK DET0009 and never executed against logs.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Package manager lifecycle hook spawning a script or download utility2id: 16eda05f-5679-4d25-a2df-ca9192abe6cb3status: experimental4description: |5  Flags a package manager or build tool creating a child process that is a script6  interpreter or a download utility — the "first run of newly written components7  triggers scripts (preinstall/postinstall), shell/PowerShell spawning" step of8  MITRE's chain. Two shapes of manager and two shapes of child are matched,9  because on Windows the canonical case runs through ComSpec rather than10  directly. The manager arms are the real executables (node.exe, python.exe,11  pip.exe, nuget.exe, dotnet.exe, choco.exe, cargo.exe) and, separately,12  cmd.exe whose own command line names a package-manager shim: npm.cmd, npx.cmd,13  yarn.cmd, pnpm.cmd, mvn.cmd, gradle.bat, npm-cli.js, node_modules or setup.py.14  Those shim names are matched in ParentCommandLine and never in ParentImage — a15  `.cmd` or `.bat` is not a process image, so `ParentImage|endswith: '\npm.cmd'`16  would render in every backend and match nothing. The child arms are an17  interpreter or downloader spawned directly, or cmd.exe spawned with one of18  those named on its command line, which is the lineage npm and yarn lifecycle19  hooks actually take (node.exe runs npm-cli.js, npm-cli.js runs the hook through20  `cmd /d /s /c`, and the payload is the grandchild). pip breaks the same way,21  with pip.exe spawning python.exe to run setup.py. The full analytic is a22  correlation — manager writes files, the new component runs, then egress to a23  non-approved registry within a 90-minute window — and Sigma can express neither24  a sequence nor a time window, so the egress half is absent. Without it there is25  nothing in the event saying the package was untrusted: this observable is a26  build tool spawning an interpreter, which is supply-chain-shaped only by27  context, and an analyst should expect to triage it as execution rather than as28  evidence of initial access. Prerequisite: Sysmon EventID 1 is not present in a29  default install, and the cmd.exe arms need command-line capture on both the30  process and its parent.31  UNVERIFIED — derived from MITRE ATT&CK DET0009 and never executed against logs.32references:33  - https://attack.mitre.org/techniques/T1195/00134  - https://attack.mitre.org/detectionstrategies/DET000935author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)36date: 2026-08-1637tags:38  - attack.initial-access39  - attack.t1195.00140logsource:41  category: process_creation42  product: windows43detection:44  selection_manager_exe:45    ParentImage|endswith:46      - '\node.exe'47      - '\python.exe'48      - '\pip.exe'49      - '\pip3.exe'50      - '\nuget.exe'51      - '\dotnet.exe'52      - '\choco.exe'53      - '\cargo.exe'54  selection_manager_shim:55    ParentImage|endswith: '\cmd.exe'56    ParentCommandLine|contains:57      - 'npm.cmd'58      - 'npx.cmd'59      - 'yarn.cmd'60      - 'pnpm.cmd'61      - 'mvn.cmd'62      - 'gradle.bat'63      - 'npm-cli.js'64      - 'node_modules'65      - 'setup.py'66  selection_child_direct:67    Image|endswith:68      - '\powershell.exe'69      - '\pwsh.exe'70      - '\wscript.exe'71      - '\cscript.exe'72      - '\mshta.exe'73      - '\curl.exe'74      - '\certutil.exe'75      - '\bitsadmin.exe'76      - '\rundll32.exe'77      - '\regsvr32.exe'78  selection_child_shell:79    Image|endswith: '\cmd.exe'80    CommandLine|contains:81      - 'powershell'82      - 'pwsh'83      - 'wscript'84      - 'cscript'85      - 'mshta'86      - 'curl'87      - 'certutil'88      - 'bitsadmin'89      - 'rundll32'90      - 'regsvr32'91  condition: 1 of selection_manager_* and 1 of selection_child_*92falsepositives:93  - "Chocolatey doing its job. Every package Chocolatey installs or upgrades runs its chocolateyInstall.ps1 through powershell.exe, so choco.exe spawning powershell.exe fires on every `choco install` and on every scheduled `choco upgrade all` across the whole estate — on a fleet that uses Chocolatey this is the rule's steady-state output and the reason it is rated low. The parent-child pair alone cannot separate it from abuse, so suppression has to key on the package and script path carried in the child CommandLine, package by package."94  - "Legitimate native-module builds. node-gyp, dotnet and gradle install steps routinely shell out to PowerShell to locate toolchains or unpack archives, so on the engineering endpoints and CI agents named by MITRE's DevHosts knob this fires on ordinary dependency restores. Baseline the parent and child pair per build pipeline before alerting."95  - "Vendor install scripts that fetch a prebuilt binary. Packages such as browser drivers and image toolchains call curl.exe or PowerShell in their postinstall hook to download from a CDN; if that CDN is already in the ApprovedRegistries allowlist the behaviour is expected and only the destination distinguishes it from the malicious case."96  - "Windows-targeted CI jobs where the build definition itself sets a package manager as the parent of a PowerShell provisioning step, producing the same parent-child pair on every run of the pipeline."97  - "Ordinary npm and yarn scripts that shell out. Any `npm run` target whose script line calls PowerShell, curl or a helper batch file matches the shim and shell arms exactly as a malicious postinstall hook does, which on a developer workstation is many events per build."98level: low

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((InitiatingProcessFolderPath endswith "\\node.exe" or InitiatingProcessFolderPath endswith "\\python.exe" or InitiatingProcessFolderPath endswith "\\pip.exe" or InitiatingProcessFolderPath endswith "\\pip3.exe" or InitiatingProcessFolderPath endswith "\\nuget.exe" or InitiatingProcessFolderPath endswith "\\dotnet.exe" or InitiatingProcessFolderPath endswith "\\choco.exe" or InitiatingProcessFolderPath endswith "\\cargo.exe") or (InitiatingProcessFolderPath endswith "\\cmd.exe" and (InitiatingProcessCommandLine contains "npm.cmd" or InitiatingProcessCommandLine contains "npx.cmd" or InitiatingProcessCommandLine contains "yarn.cmd" or InitiatingProcessCommandLine contains "pnpm.cmd" or InitiatingProcessCommandLine contains "mvn.cmd" or InitiatingProcessCommandLine contains "gradle.bat" or InitiatingProcessCommandLine contains "npm-cli.js" or InitiatingProcessCommandLine contains "node_modules" or InitiatingProcessCommandLine contains "setup.py"))) and ((FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe" or FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\curl.exe" or FolderPath endswith "\\certutil.exe" or FolderPath endswith "\\bitsadmin.exe" or FolderPath endswith "\\rundll32.exe" or FolderPath endswith "\\regsvr32.exe") or (FolderPath endswith "\\cmd.exe" and (ProcessCommandLine contains "powershell" or ProcessCommandLine contains "pwsh" or ProcessCommandLine contains "wscript" or ProcessCommandLine contains "cscript" or ProcessCommandLine contains "mshta" or ProcessCommandLine contains "curl" or ProcessCommandLine contains "certutil" or ProcessCommandLine contains "bitsadmin" or ProcessCommandLine contains "rundll32" or ProcessCommandLine contains "regsvr32"))))

Splunk · SPL

Run this as a search.

index=* (((ParentImage="*\\node.exe" OR ParentImage="*\\python.exe" OR ParentImage="*\\pip.exe" OR ParentImage="*\\pip3.exe" OR ParentImage="*\\nuget.exe" OR ParentImage="*\\dotnet.exe" OR ParentImage="*\\choco.exe" OR ParentImage="*\\cargo.exe") OR (ParentImage="*\\cmd.exe" AND (ParentCommandLine="*npm.cmd*" OR ParentCommandLine="*npx.cmd*" OR ParentCommandLine="*yarn.cmd*" OR ParentCommandLine="*pnpm.cmd*" OR ParentCommandLine="*mvn.cmd*" OR ParentCommandLine="*gradle.bat*" OR ParentCommandLine="*npm-cli.js*" OR ParentCommandLine="*node_modules*" OR ParentCommandLine="*setup.py*"))) AND ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\curl.exe" OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe") OR (Image="*\\cmd.exe" AND (CommandLine="*powershell*" OR CommandLine="*pwsh*" OR CommandLine="*wscript*" OR CommandLine="*cscript*" OR CommandLine="*mshta*" OR CommandLine="*curl*" OR CommandLine="*certutil*" OR CommandLine="*bitsadmin*" OR CommandLine="*rundll32*" OR CommandLine="*regsvr32*"))))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.parent.executable) LIKE "*\\\\node.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\python.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\pip.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\pip3.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\nuget.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\dotnet.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\choco.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\cargo.exe") OR (TO_LOWER(process.parent.executable) LIKE "*\\\\cmd.exe" AND (TO_LOWER(process.parent.command_line) LIKE "*npm.cmd*" OR TO_LOWER(process.parent.command_line) LIKE "*npx.cmd*" OR TO_LOWER(process.parent.command_line) LIKE "*yarn.cmd*" OR TO_LOWER(process.parent.command_line) LIKE "*pnpm.cmd*" OR TO_LOWER(process.parent.command_line) LIKE "*mvn.cmd*" OR TO_LOWER(process.parent.command_line) LIKE "*gradle.bat*" OR TO_LOWER(process.parent.command_line) LIKE "*npm-cli.js*" OR TO_LOWER(process.parent.command_line) LIKE "*node_modules*" OR TO_LOWER(process.parent.command_line) LIKE "*setup.py*"))) AND ((TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mshta.exe" OR TO_LOWER(process.executable) LIKE "*\\\\curl.exe" OR TO_LOWER(process.executable) LIKE "*\\\\certutil.exe" OR TO_LOWER(process.executable) LIKE "*\\\\bitsadmin.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rundll32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\regsvr32.exe") OR (TO_LOWER(process.executable) LIKE "*\\\\cmd.exe" AND (TO_LOWER(process.command_line) LIKE "*powershell*" OR TO_LOWER(process.command_line) LIKE "*pwsh*" OR TO_LOWER(process.command_line) LIKE "*wscript*" OR TO_LOWER(process.command_line) LIKE "*cscript*" OR TO_LOWER(process.command_line) LIKE "*mshta*" OR TO_LOWER(process.command_line) LIKE "*curl*" OR TO_LOWER(process.command_line) LIKE "*certutil*" OR TO_LOWER(process.command_line) LIKE "*bitsadmin*" OR TO_LOWER(process.command_line) LIKE "*rundll32*" OR TO_LOWER(process.command_line) LIKE "*regsvr32*"))))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 4 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)(\\node\.exe$|\\python\.exe$|\\pip\.exe$|\\pip3\.exe$|\\nuget\.exe$|\\dotnet\.exe$|\\choco\.exe$|\\cargo\.exe$)</field>    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\mshta\.exe$|\\curl\.exe$|\\certutil\.exe$|\\bitsadmin\.exe$|\\rundll32\.exe$|\\regsvr32\.exe$)</field>    <description>Package manager lifecycle hook spawning a script or download utility (1/4)</description>    <mitre>      <id>T1195.001</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)(\\node\.exe$|\\python\.exe$|\\pip\.exe$|\\pip3\.exe$|\\nuget\.exe$|\\dotnet\.exe$|\\choco\.exe$|\\cargo\.exe$)</field>    <field name="Image" type="pcre2">(?i)\\cmd\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(powershell|pwsh|wscript|cscript|mshta|curl|certutil|bitsadmin|rundll32|regsvr32)</field>    <description>Package manager lifecycle hook spawning a script or download utility (2/4)</description>    <mitre>      <id>T1195.001</id>    </mitre>  </rule>   <rule id="100002" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)\\cmd\.exe$</field>    <field name="ParentCommandLine" type="pcre2">(?i)(npm\.cmd|npx\.cmd|yarn\.cmd|pnpm\.cmd|mvn\.cmd|gradle\.bat|npm-cli\.js|node_modules|setup\.py)</field>    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\mshta\.exe$|\\curl\.exe$|\\certutil\.exe$|\\bitsadmin\.exe$|\\rundll32\.exe$|\\regsvr32\.exe$)</field>    <description>Package manager lifecycle hook spawning a script or download utility (3/4)</description>    <mitre>      <id>T1195.001</id>    </mitre>  </rule>   <rule id="100003" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)\\cmd\.exe$</field>    <field name="ParentCommandLine" type="pcre2">(?i)(npm\.cmd|npx\.cmd|yarn\.cmd|pnpm\.cmd|mvn\.cmd|gradle\.bat|npm-cli\.js|node_modules|setup\.py)</field>    <field name="Image" type="pcre2">(?i)\\cmd\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(powershell|pwsh|wscript|cscript|mshta|curl|certutil|bitsadmin|rundll32|regsvr32)</field>    <description>Package manager lifecycle hook spawning a script or download utility (4/4)</description>    <mitre>      <id>T1195.001</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: trusted_software_tampering
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 3 Sept 2026
Rule ID: 16eda05f-5679-4d25-a2df-ca9192abe6cb

ATT&CKT1195.001

T1195.001Compromise Software Dependencies and Development Tools

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
0 true · 1 false · 100.0% noise

Noise checkfires on 1 of 30

Fires on 1 of 30 ordinary behaviours the baseline holds for this log type. Each is something a managed estate does on purpose, so each is a false positive an analyst would have to close.

pc-curl-deployment
A build agent calling an internal API with the in-box curl. Windows has shipped curl.exe since 1803.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1195.001, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 5 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Filter out known legitimate parent processes by adding additional conditions to the selection_manager_exe and selection_manager_shim selections.
Exclude specific child processes that are known to be legitimate by adding additional conditions to the selection_child_direct and selection_child_shell selections.
Add a condition to filter out events where the ParentCommandLine or CommandLine fields contain specific keywords or phrases that are indicative of legitimate activity.
Consider adding a condition to require the child process to be spawned from a specific directory or path that is commonly used by package managers.

Declared by the author

Chocolatey doing its job. Every package Chocolatey installs or upgrades runs its chocolateyInstall.ps1 through powershell.exe, so choco.exe spawning powershell.exe fires on every choco install and on every scheduled choco upgrade all across the whole estate — on a fleet that uses Chocolatey this is the rule's steady-state output and the reason it is rated low. The parent-child pair alone cannot separate it from abuse, so suppression has to key on the package and script path carried in the child CommandLine, package by package.
Legitimate native-module builds. node-gyp, dotnet and gradle install steps routinely shell out to PowerShell to locate toolchains or unpack archives, so on the engineering endpoints and CI agents named by MITRE's DevHosts knob this fires on ordinary dependency restores. Baseline the parent and child pair per build pipeline before alerting.
Vendor install scripts that fetch a prebuilt binary. Packages such as browser drivers and image toolchains call curl.exe or PowerShell in their postinstall hook to download from a CDN; if that CDN is already in the ApprovedRegistries allowlist the behaviour is expected and only the destination distinguishes it from the malicious case.
Windows-targeted CI jobs where the build definition itself sets a package manager as the parent of a PowerShell provisioning step, producing the same parent-child pair on every run of the pipeline.
Ordinary npm and yarn scripts that shell out. Any npm run target whose script line calls PowerShell, curl or a helper batch file matches the shim and shell arms exactly as a malicious postinstall hook does, which on a developer workstation is many events per build.

Lessontrusted software tampering

trusted software tamperingAI draft — unreviewed

01 · What this rule detects

This Sigma rule detects the execution of scripts or download utilities spawned by package manager lifecycle hooks, which could indicate trusted software tampering. The rule focuses on identifying potential malicious activity where a package manager, such as node.exe, python.exe, or pip.exe, spawns a child process that is a script interpreter or a download utility, which may be used to download and execute malicious code.

02 · Telemetry you need

Log source: process_creation
Product: windows
Specific fields: ParentImage, ParentCommandLine, Image, CommandLine
Audit setting: Process creation events must be audited, which may require enabling audit policies for process creation.

03 · How the logic works

The rule uses four selections to identify potential malicious activity: selection_manager_exe, selection_manager_shim, selection_child_direct, and selection_child_shell. The selection_manager_exe and selection_manager_shim selections identify the parent process as a package manager, while the selection_child_direct and selection_child_shell selections identify the child process as a script interpreter or download utility. The condition requires at least one of the selection_manager_* selections and at least one of the selection_child_* selections to be true, indicating that a package manager has spawned a potentially malicious child process.

04 · Common false positives

Legitimate use of package managers to install or update software, which may spawn script interpreters or download utilities as part of the installation process.
Automated build or deployment scripts that use package managers and script interpreters.
Software development environments where package managers and script interpreters are frequently used.
System administration tasks that involve using package managers and script interpreters to manage software installations.

05 · Detection maturity

tier_1: The rule as written may generate a high volume of false positives due to its broad coverage of package managers and script interpreters.
tier_2: With tuning, such as filtering out known legitimate parent and child processes, the rule can become more effective at detecting malicious activity while reducing false positives.
tier_3: Correlating this rule with other signals, such as network traffic or file system activity, can help to further reduce false positives and improve the overall detection capability.

Related detections6 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/16eda05f-5679-4d25-a2df-ca9192abe6cb

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Package manager lifecycle hook spawning a script or download utility

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it