Sigma rule: New Agent Skills Installation Attempt Via Node.EXE

Rule

Title

New Agent Skills Installation Attempt Via Node.EXE

Status

experimental

Level

medium

Author

Marco Pedrinazzi (@pedrinazziM) (InTheCyber)

Date

2026-02-03

File

rules/windows/process_creation/proc_creation_win_node_new_agent_skills_installed.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the attempt to install new skills for AI agents using the "npx skills" command.
Agent skills enhance AI agents with new capabilities, but attackers may abuse this mechanism to inject malicious commands executed by the agent on behalf of the user.
The "npx skills" command can install skills for various agents (e.g., Claude Code, Cursor, and others).
Analysts should review any installed skills to verify their legitimacy.
Note: Tune this rule based on whether AI agent tooling is allowed in your environment.
In environments where such tooling is authorized, this detection may reflect normal activity and the alert level should be adjusted accordingly.
In environments where AI agent tooling is not permitted, this activity is likely suspicious and may require immediate investigation.

Log source

product

windows

category

process_creation

Detection

selection_img:
    - Image|endswith: '\node.exe'
    - OriginalFileName: 'node.exe'
selection_cli:
    CommandLine|contains|all:
        - 'npx-cli.js'
        - 'skills '
        - ' add '
condition: all of selection_*

False positives (as the rule lists them)

• This rule will be triggered when a new agent skill is installed regardless if it is benign or malicious.
• High false positive rate expected in environments where AI agent tooling is authorized and commonly used.

Tags

• attack.execution
• attack.t1059.007

MITRE ATT&CK ids this rule names

• T1059.007

References

• https://blog.lukaszolejnik.com/supply-chain-risk-of-agentic-ai-infecting-infrastructures-via-skill-worms/
• https://github.com/vercel-labs/skills/blob/1f7fbc8d0e49c4e0601d364696bd1bdd15e80967/README.md
• https://opensourcemalware.com/blog/clawdbot-skills-ganked-your-crypto
• https://promptintel.novahunting.ai/molt

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_node_new_agent_skills_installed.yml