Compromised Axios npm package version (1.14.1 and 0.30.4) C2 on Command Line

Ali AlEnezi@site

•updated Apr 5, 2026•4•0•199

This rule detects the first stage of activity once a compromised endpoint runs the affected Axios package (versions 1.14.1 and 0.30.4). It specifically looks for process creation events where the command line contains a call out to the C2 domain 'sfrclak.com'. This indicates the dropper scripts attempting to establish communication with their command and control server.