Techniques
Sample rules
New Agent Skills Installation Attempt Via Node.EXE
- source: sigma
- technicques:
- t1059
- t1059.007
Description
Detects the attempt to install new skills for AI agents using the “npx skills” command. Agent skills enhance AI agents with new capabilities, but attackers may abuse this mechanism to inject malicious commands executed by the agent on behalf of the user. The “npx skills” command can install skills for various agents (e.g., Claude Code, Cursor, and others). Analysts should review any installed skills to verify their legitimacy. Note: Tune this rule based on whether AI agent tooling is allowed in your environment. In environments where such tooling is authorized, this detection may reflect normal activity and the alert level should be adjusted accordingly. In environments where AI agent tooling is not permitted, this activity is likely suspicious and may require immediate investigation.
Detection logic
condition: all of selection_*
selection_cli:
CommandLine|contains|all:
- npx-cli.js
- 'skills '
- ' add '
selection_img:
- Image|endswith: \node.exe
- OriginalFileName: node.exe