Axios Supply Chain Attack: Payload Execution & Registry Persistence Detection

Tun Tun Naing@tuntun

•updated Apr 1, 2026•109•1•2,788

Detects indicators associated with the axios npm supply chain compromise by identifying suspicious payload execution (wt.exe in ProgramData) and persistence via the Windows Run registry key (MicrosoftUpdate). The rule triggers when either behavior is observed, providing visibility into potential post-compromise activity on Windows endpoints.