Miasma npm Supply Chain - Suspicious node-gyp Execution Triggered by binding.gyp During Package Install
This rule detects potentially malicious software supply chain activity by monitoring for the execution of 'node-gyp' or 'node-pre-gyp' during the installation of Node.js packages (e.g., via npm or yarn). It specifically flags instances where the process or its parent involves suspicious file names or directory paths often associated with 'Miasma' supply chain campaigns, such as references to 'leo-logger', 'binding.gyp', or 'index.js' inside 'node_modules' directories.
Microsoft Sentinel (KQL)
