NPM Package Named Searches
These queries detect file write events (typically FileWritten or similar) involving specific npm-related package files on endpoints. They are designed for threat hunting, supply chain monitoring, and investigating the installation or dropping of particular Node.js packages.
CQL · Falcon Next-Gen SIEMCopy query
//Single package check
#event_simpleName=/written/i TargetFileName=*jscrambler@*
| groupBy([@timestamp, event_platform, #event_simpleName, ComputerName, TargetFileName, ParentBaseFileName, GrandParentBaseFileName, CommandLine])
//For multiple packages with versions
#event_simpleName=/written/i (TargetFileName=/chalk-5\.6\.1/i) OR (TargetFileName=/supports-hyperlinks-4\.1\.1/i) OR (TargetFileName=/chalk-template-1\.1\.1/i) OR (TargetFileName=/slice-ansi-7\.1\.1/i) OR (TargetFileName=/wrap-ansi-9\.0\.1/i) OR (TargetFileName=/has-ansi-6\.0\.1/i) OR (TargetFileName=/strip-ansi-7\.1\.1/i) OR (TargetFileName=/ansi-styles-6\.2\.2/i) OR (TargetFileName=/supports-color-10\.2\.1/i) OR (TargetFileName=/ansi-regex-6\.2\.1/i) OR (TargetFileName=/debug-4\.4\.2/i) OR (TargetFileName=/color-convert-3\.1\.1/i) OR (TargetFileName=/color-name-2\.0\.1/i) OR (TargetFileName=/is-arrayish-0\.3\.3/i) OR (TargetFileName=/color-5\.0\.1/i) OR (TargetFileName=/color-string-2\.1\.1/i) OR (TargetFileName=/simple-swizzle-0\.2\.3/i) OR (TargetFileName=/backslash-0\.2\.1/i)
| groupBy([@timestamp, event_platform, #event_simpleName, ComputerName, TargetFileName, ParentBaseFileName, GrandParentBaseFileName, CommandLine])These queries detect file write events (typically FileWritten or similar) involving specific npm-related package files on endpoints. They are designed for threat hunting, supply chain monitoring, and investigating the installation or dropping of particular Node.js packages.
How to adapt:
- Replace jscrambler@ with any other scoped or unscoped package pattern.
- Add or remove packages in the OR chain as needed.
- Add | filter ... clauses for specific users, directories, or time windows.
npm_package_named_searches.yml
T1204.005, T1195.001
Hem Karlapalem
Hunting, Detection
Endpoint
Insight
2026-07-29
2026-07-29
