Create proc_creation_win_malware_dindoor_deno_remote_js.yml

Author: marcopedrinazzi

rules-emerging-threats/2026/Malware/DinDoor-Backdoor/proc_creation_win_malware_dindoor_deno_remote_js.yml

@@ -0,0 +1,37 @@
+title: DinDoor Backdoor Deno Remote JavaScript Execution From PowerShell
+id: 75dd8ce3-9804-461e-8421-782eaaf6774e
+status: experimental
+description: Detects Deno launched from PowerShell with full permissions to execute remote JavaScript as observed in DinDoor Backdoor MSI installer chains.
+references:
+    - https://posts.inthecyber.com/dindoor-is-back-fake-chatgpt-and-claude-installers-show-muddywater-linked-payloads-b3cd8d9e1827
+    - https://www.malwarebytes.com/blog/threat-intel/2026/05/fake-software-on-github-and-sourceforge-distribute-deno-rat
+    - https://hunt.io/blog/dindoor-deno-runtime-backdoor-msi-analysis
+author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
+date: 2026-06-25
+tags:
+    - attack.execution
+    - attack.t1059.001
+    - attack.t1059.007
+    - detection.emerging-threats
+logsource:
+    product: windows
+    category: process_creation
+detection:
+    selection_img:
+        Image|endswith: '\deno.exe'
+    selection_parent:
+        ParentImage|endswith:
+            - '\powershell.exe'
+    selection_full_perms:
+        CommandLine|contains: 
+            - '-A' # skip the sandbox entirely
+            - '--allow-all' # skip the sandbox entirely
+    selection_remote_source:
+        CommandLine|contains:
+            - 'http:'
+            - 'https:'
+            - 'data:application/javascript;base64'
+    condition: selection_img and selection_parent and selection_full_perms and selection_remote_source
+falsepositives:
+    - Legitimate PowerShell automation using Deno with full permissions to execute remote JavaScript.
+level: high