Unsigned .node File Loaded

 1title: Unsigned .node File Loaded
 2id: e5f5c693-52d7-4de5-88ae-afbfbce85595
 3status: experimental
 4description: |
 5    Detects the loading of unsigned .node files.
 6    Adversaries may abuse a lack of .node integrity checking to execute arbitrary code inside of trusted applications such as Slack.
 7    .node files are native add-ons for Electron-based applications, which are commonly used for desktop applications like Slack, Discord, and Visual Studio Code.
 8    This technique has been observed in the DripLoader malware, which uses unsigned .node files to load malicious native code into Electron applications.    
 9references:
10    - https://www.coreycburton.com/blog/driploader-case-study
11    - https://github.com/CoreyCBurton/DripLoaderNG
12    - https://www.electronjs.org/docs/latest/tutorial/native-code-and-electron
13author: Jonathan Beierle (@hullabrian)
14date: 2025-11-22
15modified: 2026-08-27
16tags:
17    - attack.execution
18    - attack.privilege-escalation
19    - attack.persistence
20    - attack.stealth
21    - attack.t1129
22    - attack.t1574.001
23    - attack.t1036.005
24logsource:
25    category: image_load
26    product: windows
27detection:
28    selection_node_extension:
29        ImageLoaded|endswith: '.node'
30    selection_status:
31        - Signed: 'false'
32        - SignatureStatus: 'Unavailable'
33    filter_optional_vscode_jupyter:
34        Image|endswith: '\Code.exe'
35        ImageLoaded|contains: '.vscode\extensions\ms-toolsai.jupyter-'
36        ImageLoaded|endswith:
37            - '\electron.napi.node'
38            - '\node.napi.glibc.node'
39    filter_optional_vscode_core:
40        Image|contains: '\Microsoft VS Code\Code.exe'
41        ImageLoaded|contains: '\Microsoft VS Code\resources\app\node_modules'
42    filter_optional_evernote:
43        Image|contains:
44            - 'C:\Program Files (x86)\'
45            - 'C:\Program Files\'
46            - '\AppData\Local\Programs\'
47        Image|endswith: '\Evernote\Evernote.exe'
48        ImageLoaded|contains: '\Evernote\resources\app'
49    condition: all of selection_* and not 1 of filter_optional_*
50falsepositives:
51    - VsCode extensions or similar legitimate tools might use unsigned .node files. These should be investigated on a case-by-case basis, and whitelisted if determined to be benign.
52level: medium