Suspicious JavaScript Execution via Deno

  1[metadata]
  2creation_date = "2026/03/19"
  3integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "system", "crowdstrike"]
  4maturity = "production"
  5updated_date = "2026/04/07"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects execution of JavaScript via Deno with suspicious command-line patterns (base64, eval, http, or import in a
 11javascript context). Adversaries may abuse Deno to run malicious JavaScript for execution or staging.
 12"""
 13from = "now-9m"
 14index = [
 15    "endgame-*",
 16    "logs-crowdstrike.fdr*",
 17    "logs-endpoint.events.process-*",
 18    "logs-m365_defender.event-*",
 19    "logs-sentinel_one_cloud_funnel.*",
 20    "logs-system.security*",
 21    "logs-windows.sysmon_operational-*",
 22    "winlogbeat-*",
 23]
 24language = "eql"
 25license = "Elastic License v2"
 26name = "Suspicious JavaScript Execution via Deno"
 27note = """## Triage and analysis
 28
 29### Investigating Suspicious JavaScript Execution via Deno
 30
 31Deno is a legitimate JavaScript/TypeScript runtime. This rule fires when a Deno process (identified by name, PE original filename, or code signer "Deno Land Inc.") is started with a command line matching suspicious patterns: javascript with base64, eval(, http, or javascript import. Such patterns are commonly used to run inline or remote scripts and can indicate abuse.
 32
 33### Possible investigation steps
 34
 35- Review process.command_line and process.args to see the exact script or URL being executed.
 36- Identify the parent process and how Deno was launched (user, script, terminal, or other tool).
 37- Check whether Deno is approved on the host; if not, treat as potential unauthorized software execution.
 38- Correlate with file creation or network events around the same time (downloads, script drops).
 39
 40### False positive analysis
 41
 42- Legitimate development or automation that runs Deno with eval, http imports, or base64-encoded snippets may trigger; allowlist by host or command-line pattern where appropriate.
 43
 44### Response and remediation
 45
 46- If abuse is confirmed: contain the host, terminate the Deno process, and remove or block Deno if not authorized; investigate how the script was delivered and scope for similar activity.
 47"""
 48references = [
 49    "https://reliaquest.com/blog/threat-spotlight-casting-a-wider-net-clickfix-deno-and-leaknets-scaling-threat",
 50    "https://deno.com/"
 51]
 52risk_score = 73
 53rule_id = "ff18d24b-2ba6-4691-a17f-75c4380d0965"
 54severity = "high"
 55tags = [
 56    "Domain: Endpoint",
 57    "OS: Windows",
 58    "Use Case: Threat Detection",
 59    "Tactic: Execution",
 60    "Resources: Investigation Guide",
 61    "Data Source: Elastic Defend",
 62    "Data Source: Sysmon",
 63    "Data Source: SentinelOne",
 64    "Data Source: Microsoft Defender XDR",
 65    "Data Source: Crowdstrike",
 66    "Data Source: Elastic Endgame", 
 67    "Data Source: Windows Security Event Logs"
 68]
 69timestamp_override = "event.ingested"
 70type = "eql"
 71
 72query = '''
 73process where host.os.type == "windows" and event.type == "start" and
 74 (process.name : "deno.exe" or ?process.pe.original_file_name == "deno.exe" or ?process.code_signature.subject_name == "Deno Land Inc.") and
 75 process.command_line : ("*javascript*base64*", "*eval(*", "*http*", "*javascript*import*")
 76'''
 77
 78[[rule.threat]]
 79framework = "MITRE ATT&CK"
 80
 81[[rule.threat.technique]]
 82id = "T1059"
 83name = "Command and Scripting Interpreter"
 84reference = "https://attack.mitre.org/techniques/T1059/"
 85
 86[[rule.threat.technique.subtechnique]]
 87id = "T1059.007"
 88name = "JavaScript"
 89reference = "https://attack.mitre.org/techniques/T1059/007/"
 90
 91[rule.threat.tactic]
 92id = "TA0002"
 93name = "Execution"
 94reference = "https://attack.mitre.org/tactics/TA0002/"
 95
 96[[rule.threat]]
 97framework = "MITRE ATT&CK"
 98
 99[[rule.threat.technique]]
100id = "T1105"
101name = "Ingress Tool Transfer"
102reference = "https://attack.mitre.org/techniques/T1105/"
103
104[rule.threat.tactic]
105id = "TA0011"
106name = "Command and Control"
107reference = "https://attack.mitre.org/tactics/TA0011/"
108
109[[rule.threat]]
110framework = "MITRE ATT&CK"
111
112[[rule.threat.technique]]
113id = "T1027"
114name = "Obfuscated Files or Information"
115reference = "https://attack.mitre.org/techniques/T1027/"
116
117[rule.threat.tactic]
118id = "TA0005"
119name = "Defense Evasion"
120reference = "https://attack.mitre.org/tactics/TA0005/"