NUL1DROPPER Slopsquatting Campaign + ChainDrop npm Worm: OTX Pulse Analysis — Supply Chain Credential Theft Detection Pack

---
title: NUL1DROPPER / ChainDrop Payload C2 Communication
id: 7f3a1c2e-9b4d-4e8a-a1f5-2c6d8e9f0a11
status: experimental
description: Detects network connections to known NUL1DROPPER staging infrastructure and ChainDrop registry-lookalike C2 domains associated with npm supply chain credential theft campaigns.
author: Security Arsenal Threat Intelligence
date: 2026/08/10
references:
    - https://opensourcemalware.com/blog/russian-ai-slopsquatting-npm-campaign
    - https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/
tags:
    - attack.command_and_control
    - attack.t1071
    - attack.t1105
logsource:
    category: dns
product: windows
selection:
    query|contains:
        - 'wel1.ru'
        - 'npm-cache.com'
        - 'pypi-get.com'
        - 'js-mirror.com'
condition: selection
falsepositives:
    - Unlikely; these domains have no legitimate business purpose
level: critical
---
title: Node.js Process Spawning Suspicious Child Process or Network Egress
id: 4b8e2d1f-6a3c-4f7b-b2e9-1d5c7a8f3b22
status: experimental
description: Detects node.exe spawning shell interpreters or scripting engines — consistent with import-time malicious package execution (NUL1DROPPER require() execution, ChainDrop payload staging in build pipelines).
author: Security Arsenal Threat Intelligence
date: 2026/08/10
tags:
    - attack.execution
    - attack.t1059
    - attack.t1195.002
logsource:
    category: process_creation
    product: windows
selection:
    ParentImage|endswith:
        - '\node.exe'
        - '\npm.cmd'
        - '\npm.exe'
    Image|endswith:
        - '\cmd.exe'
        - '\powershell.exe'
        - '\pwsh.exe'
        - '\wscript.exe'
        - '\cscript.exe'
        - '\curl.exe'
        - '\certutil.exe'
filter_ci:
    CommandLine|contains:
        - 'npm install'
        - 'npm ci'
        - 'node-gyp'
condition: selection and not filter_ci
falsepositives:
    - Legitimate build tooling in CI/CD; tune filters per environment
level: high
---
title: Sliver Implant Persistence via Registry Run Key
id: 9c1f5a3d-2e7b-4d6c-c3a8-5f9e2b7d4c33
status: experimental
description: Detects registry Run key persistence established by node/npm spawned processes — consistent with Sliver implant deployment following NUL1DROPPER execution.
author: Security Arsenal Threat Intelligence
date: 2026/08/10
tags:
    - attack.persistence
    - attack.t1060
    - attack.t1547.001
logsource:
    category: registry_set
    product: windows
selection:
    TargetObject|contains:
        - '\CurrentVersion\Run'
        - '\CurrentVersion\RunOnce'
    Image|endswith:
        - '\node.exe'
        - '\powershell.exe'
        - '\cmd.exe'
    Details|contains:
        - 'AppData'
        - 'Temp'
condition: selection
falsepositives:
    - Rare in developer workstations; legitimate Electron apps may register Run keys under Program Files instead
level: high

// Hunt: npm supply chain compromise — ChainDrop & NUL1DROPPER indicators and node egress behavior
let MaliciousDomains = dynamic(["wel1.ru", "sdk.dl.wel1.ru", "ext.dl.wel1.ru", "pkg.dl.wel1.ru", "net.dl.wel1.ru", "npm-cache.com", "pypi-get.com", "js-mirror.com"]);
let MaliciousHashes = dynamic([
    "0fc30f82e1fa5e51a6c0c43f3ed7f13592ea731cb331e43a4d085df60a4db8b6",
    "d30b4ea6f68456672f5abb35e9dcf7d54226372b66e9d60a7ee26b7a52568e74",
    "54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668",
    "9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc"
]);
let NetworkHits = DeviceNetworkEvents
    | where TimeGenerated > ago(90d)
    | where RemoteUrl has_any (MaliciousDomains)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort;
let FileHits = DeviceFileEvents
    | where TimeGenerated > ago(90d)
    | where SHA256 in~ (MaliciousHashes) or MD5 in~ ("d382fdae4e2675b94419fdb115dbd397")
    | project TimeGenerated, DeviceName, FolderPath, FileName, SHA256, InitiatingProcessFileName;
let NodeEgress = DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName in~ ("node.exe", "node", "npm.exe", "npm.cmd")
    | where RemoteUrl !has_any ("registry.npmjs.org", "registry.yarnpkg.com", "github.com", "nodejs.org") and isnotempty(RemoteUrl)
    | summarize ConnectionCount = count(), DistinctDestinations = dcount(RemoteUrl), Destinations = make_set(RemoteUrl, 20) by DeviceName, InitiatingProcessCommandLine
    | where DistinctDestinations > 3;
union NetworkHits, FileHits
| union (NodeEgress | project TimeGenerated = TimeGenerated, DeviceName, InitiatingProcessCommandLine, RemoteUrl = tostring(Destinations))
| sort by TimeGenerated desc

# Security Arsenal — npm Supply Chain Compromise Hunt (NUL1DROPPER / ChainDrop / Sliver)
# Run on developer workstations and CI build agents. Requires elevation for full coverage.

$MaliciousDomains = @("wel1.ru","sdk.dl.wel1.ru","ext.dl.wel1.ru","pkg.dl.wel1.ru","net.dl.wel1.ru","npm-cache.com","pypi-get.com","js-mirror.com")
$MaliciousHashes = @(
    "0fc30f82e1fa5e51a6c0c43f3ed7f13592ea731cb331e43a4d085df60a4db8b6",
    "d30b4ea6f68456672f5abb35e9dcf7d54226372b66e9d60a7ee26b7a52568e74",
    "54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668",
    "9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc",
    "d382fdae4e2675b94419fdb115dbd397"
)

Write-Host "[1] Active network connections to malicious C2/staging domains..." -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
    $r = try { (Resolve-DnsName -Name $_.RemoteAddress -ErrorAction Stop -QuickTimeout).NameHost } catch { $null }
    foreach ($d in $MaliciousDomains) {
        if ($r -like "*$d*") { "[HIT] PID $($_.OwningProcess) -> $($_.RemoteAddress):$($_.RemotePort) ($r)" }
    }
}

Write-Host "[2] DNS client cache check for malicious domains..." -ForegroundColor Cyan
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object {
    $e = $_.Entry; $MaliciousDomains | Where-Object { $e -like "*$_*" }
} | Select-Object Entry, Data | Format-Table -AutoSize

Write-Host "[3] Hash sweep of npm cache and node_modules directories..." -ForegroundColor Cyan
$SweepPaths = @("$env:APPDATA\npm-cache", "$env:LOCALAPPDATA\npm-cache", "$env:USERPROFILE\.npm")
foreach ($p in $SweepPaths) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
            $h = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($MaliciousHashes -contains $h) { "[HIT] Malicious file: $($_.FullName) SHA256=$h" }
        }
    }
}

Write-Host "[4] Registry Run key persistence check (Sliver-style)..." -ForegroundColor Cyan
$RunKeys = @("HKCU:\Software\Microsoft\Windows\CurrentVersion\Run","HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce","HKLM:\Software\Microsoft\Windows\CurrentVersion\Run")
foreach ($k in $RunKeys) {
    if (Test-Path $k) {
        (Get-ItemProperty $k).PSObject.Properties | Where-Object {
            $_.Value -match "AppData|Temp|node|npm" -and $_.Name -notmatch "PSPath|PSParent"
        } | ForEach-Object { "[SUSPICIOUS] $k :: $($_.Name) = $($_.Value)" }
    }
}

Write-Host "[5] Scheduled tasks spawning node/npm or executing from user-writable paths..." -ForegroundColor Cyan
Get-ScheduledTask -ErrorAction SilentlyContinue | ForEach-Object {
    $actions = $_.Actions | ForEach-Object { "$($_.Execute) $($_.Arguments)" }
    if ($actions -match "node|npm|AppData|Temp") { "[REVIEW] Task: $($_.TaskName) :: $actions" }
}

Write-Host "[6] Credential exposure check — npm/GitHub tokens in environment and config files..." -ForegroundColor Cyan
$tokenFiles = @("$env:USERPROFILE\.npmrc", "$env:USERPROFILE\.git-credentials", "$env:USERPROFILE\.ssh")
foreach ($f in $tokenFiles) { if (Test-Path $f) { "[PRESENT] $f exists — rotate associated credentials if host shows other hits" } }

Write-Host "Hunt complete. Any [HIT] findings require immediate isolation and credential rotation." -ForegroundColor Yellow