Rule Info
Name
Unsigned .node File Loaded
Author
Jonathan Beierle (@hullabrian)
Description
Detects the loading of unsigned .node files.
Adversaries may abuse a lack of .node integrity checking to execute arbitrary code inside of trusted applications such as Slack.
.node files are native add-ons for Electron-based applications, which are commonly used for desktop applications like Slack, Discord, and Visual Studio Code.
This technique has been observed in the DripLoader malware, which uses unsigned .node files to load malicious native code into Electron applications.
Date
2025-11-22 00:00:00
Modified
None
Id
e5f5c693-52d7-4de5-88ae-afbfbce85595
Tags
attack.execution attack.privilege-escalation attack.persistence attack.defense-evasion attack.t1129 attack.t1574.001 attack.t1036.005
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Scan your endpoints, forensic images or collected files with our portable scanner THOR