Add AsyncAPI npm compromise NodeJS masquerade detections

Author: Finn-Ashby

rules-emerging-threats/2026/Malware/AsyncAPI-NPM-Compromise/file_event_lnx_asyncapi_nodejs_masquerade.yml

@@ -0,0 +1,29 @@
+title: AsyncAPI - NodeJS Masquerade Directory File (Linux)
+id: 653e415a-6576-4e06-8674-96baab0b2c51
+status: experimental
+description: |
+    Detects file creation in ~/.local/share/NodeJS, the Linux masquerade directory used by the AsyncAPI npm supply chain compromise.
+    Broadened beyond the known sync.js filename to catch campaign variants that may use a different filename but same directory masquerade technique.
+references:
+    - https://www.microsoft.com/en-us/security/blog/2026/07/15/unpacking-asyncapi-npm-supply-chain-compromise-import-time-payload-delivery/
+    - https://securitylabs.datadoghq.com/articles/compromised-asyncapi-npm-packages/
+author: Finn Ashby
+date: 2026-07-17
+tags:
+    - attack.defense-evasion
+    - attack.t1036
+    - attack.t1195.002
+    - detection.emerging-threats
+logsource:
+    category: file_event
+    product: linux
+detection:
+    selection:
+        TargetFilename|contains: '/.local/share/NodeJS/'
+    condition: selection
+fields:
+    - TargetFilename
+    - Image
+falsepositives:
+    - Legitimate software creating files in ~/.local/share/NodeJS
+level: medium

rules-emerging-threats/2026/Malware/AsyncAPI-NPM-Compromise/file_event_macos_asyncapi_nodejs_masquerade.yml

@@ -0,0 +1,29 @@
+title: AsyncAPI - NodeJS Masquerade Directory File (macOS)
+id: b8dacebb-4171-43a2-b1aa-f2173606ccb5
+status: experimental
+description: |
+    Detects file creation in ~/Library/Application Support/NodeJS, the macOS masquerade directory used by the AsyncAPI npm supply chain compromise.
+    Broadened beyond the known sync.js filename to catch campaign variants that may use a different filename but same directory masquerade technique.
+references:
+    - https://www.microsoft.com/en-us/security/blog/2026/07/15/unpacking-asyncapi-npm-supply-chain-compromise-import-time-payload-delivery/
+    - https://securitylabs.datadoghq.com/articles/compromised-asyncapi-npm-packages/
+author: Finn Ashby
+date: 2026-07-17
+tags:
+    - attack.defense-evasion
+    - attack.t1036
+    - attack.t1195.002
+    - detection.emerging-threats
+logsource:
+    category: file_event
+    product: macos
+detection:
+    selection:
+        TargetFilename|contains: '/Library/Application Support/NodeJS/'
+    condition: selection
+fields:
+    - TargetFilename
+    - Image
+falsepositives:
+    - Legitimate software creating files in ~/Library/Application Support/NodeJS
+level: medium

rules-emerging-threats/2026/Malware/AsyncAPI-NPM-Compromise/file_event_win_asyncapi_nodejs_masquerade.yml

@@ -0,0 +1,29 @@
+title: AsyncAPI - NodeJS Masquerade Directory File (Windows)
+id: 76601436-e854-4a4d-9d86-19c74680bac3
+status: experimental
+description: |
+    Detects file creation in %LOCALAPPDATA%\NodeJS, the Windows masquerade directory used by the AsyncAPI npm supply chain compromise.
+    Broadened beyond the known sync.js filename to catch campaign variants that may use a different filename but same directory masquerade technique.
+references:
+    - https://www.microsoft.com/en-us/security/blog/2026/07/15/unpacking-asyncapi-npm-supply-chain-compromise-import-time-payload-delivery/
+    - https://securitylabs.datadoghq.com/articles/compromised-asyncapi-npm-packages/
+author: Finn Ashby
+date: 2026-07-17
+tags:
+    - attack.defense-evasion
+    - attack.t1036
+    - attack.t1195.002
+    - detection.emerging-threats
+logsource:
+    category: file_event
+    product: windows
+detection:
+    selection:
+        TargetFilename|contains: '\AppData\Local\NodeJS\'
+    condition: selection
+fields:
+    - TargetFilename
+    - Image
+falsepositives:
+    - Legitimate software creating files in %LOCALAPPDATA%\NodeJS
+level: medium