Emerging Threathighexperimental

Axios NPM Compromise Malicious C2 Domain DNS Query

Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. This detection detects endpoints attempting to resolve the attacker's C2 domain (sfrclak.com) used for command and control communication.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Swachchhanda Shrawan Poudel (Nextron Systems)Created Wed Apr 0173e5d24f-493f-4092-bd2f-c72cabda40ee2026

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

dns

Categorydns← raw: dns

Detection Logic

detection:
    selection:
        query:
            - 'sfrclak.com'
            - 'calltan.com'
            - 'callnrwise.com'
    condition: selection

False Positives

Unlikely

False positives are unlikely for most environments. High confidence detection.

References