Sigma rule: Suspicious Deno File Written from Remote Source

Rule

Title

Suspicious Deno File Written from Remote Source

Status

experimental

Level

low

Author

Josh Nickels, Michael Taggart

Date

2025-05-22

File

rules/windows/file/file_event/file_event_win_creation_deno.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious DLL.
This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.

Log source

product

windows

category

file_event

Detection

selection_path:
    TargetFilename|contains:
        - '\deno\gen\'
        - '\deno\remote\https\'
    TargetFilename|contains|all:
        - ':\Users\'
        - '\AppData\'
condition: selection_path

False positives (as the rule lists them)

• Legitimate usage of deno to request a file or bring a DLL to a host

Tags

• attack.execution
• attack.t1204
• attack.t1059.007
• attack.command-and-control
• attack.t1105

MITRE ATT&CK ids this rule names

• T1059.007
• T1105
• T1204

References

• https://taggart-tech.com/evildeno/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_creation_deno.yml