Suspicious Spectral CLI Execution from NPX Cache
Detects the execution of the Stoplight Spectral CLI tool from within the temporary npm/npx cache directory structure on Windows endpoints. This behavior is associated with supply-chain attacks, where malicious packages exploit npx cache paths to execute unauthorized code. The rule accounts for both fixed cache identifiers observed in specific campaigns and generalized paths used by npx, while excluding benign Playwright test executions.
Microsoft Sentinel (KQL)
