Threat Hunting
Difficulty: hard
Log Format: syslog
Trojan Horse
A security researcher publicly disclosed that a popular npm package released 3 weeks ago contained a malicious payload. The code was dormant until an exact hostname matched — yours. Your prod environment just lit up with outbound connections to Telegram. Time to figure out what was downloaded and who is affected.
Supply ChainMalwareCode Injection
Investigation Scenario
A security researcher publicly disclosed that a popular npm package released 3 weeks ago contained a malicious payload. The code was dormant until an exact hostname matched — yours. Your prod environment just lit up with outbound connections to Telegram. Time to figure out what was downloaded and who is affected.