Suspicious Deno File Written from Remote Source

Title: Suspicious Deno File Written from Remote Source
Status: experimental
Description:Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious DLL. This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.
References:
  -https://taggart-tech.com/evildeno/
Author: Josh Nickels, Michael Taggart
Date: 2025-05-22
modified:None
Tags:

• -'attack.execution'
• -'attack.t1204'
• -'attack.t1059.007'
• -'attack.command-and-control'
• -'attack.t1105'

Logsource:

• category: file_event
• product: windows

Detection:
  selection_path:
    TargetFilename|contains:
      -'\deno\gen\'
      -'\deno\remote\https\'

    TargetFilename|contains|all:
      -':\Users\'
      -'\AppData\'

  condition:selection_path
Falsepositives:
  -Legitimate usage of deno to request a file or bring a DLL to a host
Level: low