Masqueraded wt.exe Process Execution - Axios Attack Chain

Tim Peck@timpeck

•updated Apr 1, 2026•20•2•379

Detects the execution of a process named 'wt.exe' (Windows Terminal) from a non-standard directory, or deliberately renamed. This behavior is associated with the Axios npm supply chain attack, where the Windows RAT dropper copies 'powershell.exe' to '%PROGRAMDATA%\wt.exe' to masquerade its execution.