Suspicious Persistence via Run Key & system.bat Execution (Axios Supply Chain Attack)
This detection identifies potential persistence and execution activity associated with a supply chain compromise involving a malicious npm package The activity focuses on: Registry-based persistence via: HKCU\Software\Microsoft\Windows\CurrentVersion\Run HKLM\Software\Microsoft\Windows\CurrentVersion\Run Suspicious execution of a batch file located in: C:\ProgramData\system.bat Attackers used these mechanisms to establish persistence and execute follow-on payloads after initial compromise via a trojanized npm dependency. This detection correlates both registry modification events and process execution telemetry to identify early-stage persistence behavior.
Cortex XDR
