Package manager lifecycle hook spawning a script or download utility

Siemphony@siemphonylowT1195.001unverified

Flags a package manager or build tool creating a child process that is a script interpreter or a download utility — the "first run of newly written components triggers scripts (preinstall/postinstall), shell/PowerShell spawning" step of MITRE's chain. Two shapes of manager and two shapes of child are matched, because on Windows the canonical case runs through ComSpec rather than directly. The manager arms are the real executables (node.exe, python.exe, pip.exe, nuget.exe, dotnet.exe, choco.exe, cargo.exe) and, separately, cmd.exe whose own command line names a package-manager shim: npm.cmd, npx.cmd, yarn.cmd, pnpm.cmd, mvn.cmd, gradle.bat, npm-cli.js, node_modules or setup.py. Those shim names are matched in ParentCommandLine and never in ParentImage — a `.cmd` or `.bat` is not a process image, so `ParentImage|endswith: '\npm.cmd'` would render in every backend and match nothing. The child arms are an interpreter or downloader spawned directly, or cmd.exe spawned with one of those named on its command line, which is the lineage npm and yarn lifecycle hooks actually take (node.exe runs npm-cli.js, npm-cli.js runs the hook through `cmd /d /s /c`, and the payload is the grandchild). pip breaks the same way, with pip.exe spawning python.exe to run setup.py. The full analytic is a correlation — manager writes files, the new component runs, then egress to a non-approved registry within a 90-minute window — and Sigma can express neither a sequence nor a time window, so the egress half is absent. Without it there is nothing in the event saying the package was untrusted: this observable is a build tool spawning an interpreter, which is supply-chain-shaped only by context, and an analyst should expect to triage it as execution rather than as evidence of initial access. Prerequisite: Sysmon EventID 1 is not present in a default install, and the cmd.exe arms need command-line capture on both the process and its parent. UNVERIFIED — derived from MITRE ATT&CK DET0009 and never executed against logs.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((InitiatingProcessFolderPath endswith "\\node.exe" or InitiatingProcessFolderPath endswith "\\python.exe" or InitiatingProcessFolderPath endswith "\\pip.exe" or InitiatingProcessFolderPath endswith "\\pip3.exe" or InitiatingProcessFolderPath endswith "\\nuget.exe" or InitiatingProcessFolderPath endswith "\\dotnet.exe" or InitiatingProcessFolderPath endswith "\\choco.exe" or InitiatingProcessFolderPath endswith "\\cargo.exe") or (InitiatingProcessFolderPath endswith "\\cmd.exe" and (InitiatingProcessCommandLine contains "npm.cmd" or InitiatingProcessCommandLine contains "npx.cmd" or InitiatingProcessCommandLine contains "yarn.cmd" or InitiatingProcessCommandLine contains "pnpm.cmd" or InitiatingProcessCommandLine contains "mvn.cmd" or InitiatingProcessCommandLine contains "gradle.bat" or InitiatingProcessCommandLine contains "npm-cli.js" or InitiatingProcessCommandLine contains "node_modules" or InitiatingProcessCommandLine contains "setup.py"))) and ((FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe" or FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\curl.exe" or FolderPath endswith "\\certutil.exe" or FolderPath endswith "\\bitsadmin.exe" or FolderPath endswith "\\rundll32.exe" or FolderPath endswith "\\regsvr32.exe") or (FolderPath endswith "\\cmd.exe" and (ProcessCommandLine contains "powershell" or ProcessCommandLine contains "pwsh" or ProcessCommandLine contains "wscript" or ProcessCommandLine contains "cscript" or ProcessCommandLine contains "mshta" or ProcessCommandLine contains "curl" or ProcessCommandLine contains "certutil" or ProcessCommandLine contains "bitsadmin" or ProcessCommandLine contains "rundll32" or ProcessCommandLine contains "regsvr32"))))

Splunk · SPL

Run this as a search.

index=* (((ParentImage="*\\node.exe" OR ParentImage="*\\python.exe" OR ParentImage="*\\pip.exe" OR ParentImage="*\\pip3.exe" OR ParentImage="*\\nuget.exe" OR ParentImage="*\\dotnet.exe" OR ParentImage="*\\choco.exe" OR ParentImage="*\\cargo.exe") OR (ParentImage="*\\cmd.exe" AND (ParentCommandLine="*npm.cmd*" OR ParentCommandLine="*npx.cmd*" OR ParentCommandLine="*yarn.cmd*" OR ParentCommandLine="*pnpm.cmd*" OR ParentCommandLine="*mvn.cmd*" OR ParentCommandLine="*gradle.bat*" OR ParentCommandLine="*npm-cli.js*" OR ParentCommandLine="*node_modules*" OR ParentCommandLine="*setup.py*"))) AND ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\curl.exe" OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe") OR (Image="*\\cmd.exe" AND (CommandLine="*powershell*" OR CommandLine="*pwsh*" OR CommandLine="*wscript*" OR CommandLine="*cscript*" OR CommandLine="*mshta*" OR CommandLine="*curl*" OR CommandLine="*certutil*" OR CommandLine="*bitsadmin*" OR CommandLine="*rundll32*" OR CommandLine="*regsvr32*"))))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.parent.executable) LIKE "*\\\\node.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\python.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\pip.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\pip3.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\nuget.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\dotnet.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\choco.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\cargo.exe") OR (TO_LOWER(process.parent.executable) LIKE "*\\\\cmd.exe" AND (TO_LOWER(process.parent.command_line) LIKE "*npm.cmd*" OR TO_LOWER(process.parent.command_line) LIKE "*npx.cmd*" OR TO_LOWER(process.parent.command_line) LIKE "*yarn.cmd*" OR TO_LOWER(process.parent.command_line) LIKE "*pnpm.cmd*" OR TO_LOWER(process.parent.command_line) LIKE "*mvn.cmd*" OR TO_LOWER(process.parent.command_line) LIKE "*gradle.bat*" OR TO_LOWER(process.parent.command_line) LIKE "*npm-cli.js*" OR TO_LOWER(process.parent.command_line) LIKE "*node_modules*" OR TO_LOWER(process.parent.command_line) LIKE "*setup.py*"))) AND ((TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mshta.exe" OR TO_LOWER(process.executable) LIKE "*\\\\curl.exe" OR TO_LOWER(process.executable) LIKE "*\\\\certutil.exe" OR TO_LOWER(process.executable) LIKE "*\\\\bitsadmin.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rundll32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\regsvr32.exe") OR (TO_LOWER(process.executable) LIKE "*\\\\cmd.exe" AND (TO_LOWER(process.command_line) LIKE "*powershell*" OR TO_LOWER(process.command_line) LIKE "*pwsh*" OR TO_LOWER(process.command_line) LIKE "*wscript*" OR TO_LOWER(process.command_line) LIKE "*cscript*" OR TO_LOWER(process.command_line) LIKE "*mshta*" OR TO_LOWER(process.command_line) LIKE "*curl*" OR TO_LOWER(process.command_line) LIKE "*certutil*" OR TO_LOWER(process.command_line) LIKE "*bitsadmin*" OR TO_LOWER(process.command_line) LIKE "*rundll32*" OR TO_LOWER(process.command_line) LIKE "*regsvr32*"))))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 4 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)(\\node\.exe$|\\python\.exe$|\\pip\.exe$|\\pip3\.exe$|\\nuget\.exe$|\\dotnet\.exe$|\\choco\.exe$|\\cargo\.exe$)</field>    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\mshta\.exe$|\\curl\.exe$|\\certutil\.exe$|\\bitsadmin\.exe$|\\rundll32\.exe$|\\regsvr32\.exe$)</field>    <description>Package manager lifecycle hook spawning a script or download utility (1/4)</description>    <mitre>      <id>T1195.001</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)(\\node\.exe$|\\python\.exe$|\\pip\.exe$|\\pip3\.exe$|\\nuget\.exe$|\\dotnet\.exe$|\\choco\.exe$|\\cargo\.exe$)</field>    <field name="Image" type="pcre2">(?i)\\cmd\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(powershell|pwsh|wscript|cscript|mshta|curl|certutil|bitsadmin|rundll32|regsvr32)</field>    <description>Package manager lifecycle hook spawning a script or download utility (2/4)</description>    <mitre>      <id>T1195.001</id>    </mitre>  </rule>   <rule id="100002" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)\\cmd\.exe$</field>    <field name="ParentCommandLine" type="pcre2">(?i)(npm\.cmd|npx\.cmd|yarn\.cmd|pnpm\.cmd|mvn\.cmd|gradle\.bat|npm-cli\.js|node_modules|setup\.py)</field>    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\mshta\.exe$|\\curl\.exe$|\\certutil\.exe$|\\bitsadmin\.exe$|\\rundll32\.exe$|\\regsvr32\.exe$)</field>    <description>Package manager lifecycle hook spawning a script or download utility (3/4)</description>    <mitre>      <id>T1195.001</id>    </mitre>  </rule>   <rule id="100003" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)\\cmd\.exe$</field>    <field name="ParentCommandLine" type="pcre2">(?i)(npm\.cmd|npx\.cmd|yarn\.cmd|pnpm\.cmd|mvn\.cmd|gradle\.bat|npm-cli\.js|node_modules|setup\.py)</field>    <field name="Image" type="pcre2">(?i)\\cmd\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(powershell|pwsh|wscript|cscript|mshta|curl|certutil|bitsadmin|rundll32|regsvr32)</field>    <description>Package manager lifecycle hook spawning a script or download utility (4/4)</description>    <mitre>      <id>T1195.001</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: trusted_software_tampering
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 3 Sept 2026
Rule ID: 16eda05f-5679-4d25-a2df-ca9192abe6cb

ATT&CKT1195.001

T1195.001Compromise Software Dependencies and Development Tools

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessontrusted software tampering

trusted software tampering

01 · What this rule detects

The software supply and servicing chain used as the delivery vehicle: a package manager's lifecycle hook spawning a script host or downloader, an installer or updater spawning a shell, or an executable landing in a protected program directory from a writer that is not the servicing stack.

02 · Telemetry you need

Process creation with parent image and full command lines — the parent-child pair is the observable
File creation events under the system and Program Files trees (Sysmon Event ID 11), with the writing image
Code-signing and publisher information, resolved downstream — the discriminator MITRE's own analytic names, and one no process or file event carries
Egress logs against the approved update endpoints, for the beacon that follows a compromised component's first run

03 · How the logic works

Three stages of one story. At dependency-install time: a package manager — node, python, pip, dotnet, choco, cargo, or cmd.exe running an npm/yarn shim — spawning PowerShell, a script host or a download utility is a lifecycle hook doing something hooks legitimately do and attackers do identically. At software-install time: msiexec, setup, install or an updater spawning a shell, script host or downloader. At rest: an .exe, .dll, .sys or .ocx created under System32, SysWOW64 or the Program Files trees by a writer outside the Windows servicing set (TrustedInstaller, TiWorker, msiexec, wusa and the antimalware updaters). Read all three as hunt-grade rather than alert-grade, and be honest about why: the dominant real-world form of a supply-chain compromise never creates a process at all — the payload is compiled into the signed vendor binary, and the discriminators that matter are the publisher's signature and the destination of the first beacon, neither of which these events carry.

04 · Common false positives

Chocolatey doing its job: every package it installs or upgrades runs its install script through PowerShell, so the pair fires on every choco upgrade all across the estate
MSI custom actions and installer frameworks (Inno, NSIS, InstallShield) shelling out to cmd or PowerShell for service registration and post-install cleanup — the dominant installer-child match, and legitimate for most vendors
Application self-updaters overwriting their own binaries under Program Files on every release — browsers, conferencing clients, runtimes — a continuous fleet-wide stream on the file-write arm
Native-module builds on developer machines and CI: node-gyp, dotnet and gradle routinely shell out to locate toolchains and unpack archives, matching on every dependency restore

05 · Detection maturity

Tier 1 — starting point: Matches the parent-child pairs and protected-path writes fleet-wide, with only the Windows servicing writers excluded.
Tier 2 — tuned: Separates developer and CI hosts from the general fleet, suppresses known packages by child command line, and narrows the write arm to the system directories.
Tier 3 — correlated: Joins the chain end to end — install, unexpected child, protected write, first egress — and resolves publisher signatures so an unsigned or newly-signed writer in a vendor's directory outranks everything else.

Tuning & false positivesexperimental · 5 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Suppress package-manager matches by the package and script path carried in the child's command line, package by package — the parent-child pair alone cannot be separated from abuse
On the file-write arm, dropping the two Program Files prefixes and keeping only System32 and SysWOW64 raises precision sharply; put the difference into a hunt query instead of an alert
Alert louder when the spawned child itself egresses — curl, certutil, bitsadmin — than on a bare cmd.exe: post-install cleanup rarely needs the network
Baseline developer endpoints and CI agents separately from the general fleet; the same pair that is noise on a build agent is signal on a finance workstation

Declared by the author

Chocolatey doing its job. Every package Chocolatey installs or upgrades runs its chocolateyInstall.ps1 through powershell.exe, so choco.exe spawning powershell.exe fires on every choco install and on every scheduled choco upgrade all across the whole estate — on a fleet that uses Chocolatey this is the rule's steady-state output and the reason it is rated low. The parent-child pair alone cannot separate it from abuse, so suppression has to key on the package and script path carried in the child CommandLine, package by package.
Legitimate native-module builds. node-gyp, dotnet and gradle install steps routinely shell out to PowerShell to locate toolchains or unpack archives, so on the engineering endpoints and CI agents named by MITRE's DevHosts knob this fires on ordinary dependency restores. Baseline the parent and child pair per build pipeline before alerting.
Vendor install scripts that fetch a prebuilt binary. Packages such as browser drivers and image toolchains call curl.exe or PowerShell in their postinstall hook to download from a CDN; if that CDN is already in the ApprovedRegistries allowlist the behaviour is expected and only the destination distinguishes it from the malicious case.
Windows-targeted CI jobs where the build definition itself sets a package manager as the parent of a PowerShell provisioning step, producing the same parent-child pair on every run of the pipeline.
Ordinary npm and yarn scripts that shell out. Any npm run target whose script line calls PowerShell, curl or a helper batch file matches the shim and shell arms exactly as a malicious postinstall hook does, which on a developer workstation is many events per build.

Noise checkfires on 1 of 30

Fires on 1 of 30 ordinary behaviours the baseline holds for this log type. Each is something a managed estate does on purpose, so each is a false positive an analyst would have to close.

pc-curl-deployment
A build agent calling an internal API with the in-box curl. Windows has shipped curl.exe since 1803.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
0 true · 1 false · 100.0% noise

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1195.001, evaluated against their process_creation events.

Share this rule

/u/siemphony/16eda05f-5679-4d25-a2df-ca9192abe6cb

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Package manager lifecycle hook spawning a script or download utility

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it