THREATOPS

THREAT OPS › Threat News › Elastic releases detections for the Axios supply chain compromise

Elastic releases detections for the Axios supply chain compromise

lowelastic_securityPublished 2026-04-01

<blockquote> <p>Elastic Security Labs is releasing an initial triage and detection rules for the Axios supply-chain compromise. We have <a href="https://www.elastic.co/security-labs/axios-one-rat-to-rule-them-all">released a detailed analysis</a> on the Axios compromise RAT and payloads.</p> <p>Elastic Security Labs filed a GitHub Security Advisory to the axios repository on March 31, 2026 at

MITRE ATT&CK techniques

Code SigningT1553.002
AppleScriptT1059.002
Supply Chain CompromiseT1195
MasqueradingT1036
PowerShellT1059.001
Process HollowingT1055.012
Invalid Code SignatureT1036.001
MasqueradingAML.T0074

Indicators of compromise

e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09sha256
6483c004e207137385f480909d6edecf1b699087378aa91745ecba7c3394f9d7sha256
ed8560c1ac7ceb6983ba995124d5917dc1a00288912387a6389296637d5f815csha256
e49c2732fb9861548208a78e72996b9c3c470b6b562576924bcc3a9fb75bf9ffsha256
92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645asha256
c932ececd9c3b1257fc0350ec2dc13a1af0d6f88sha1
278054cb0e90dca20d6fe06f63cce6600902d50dsha1
d6f3f62fd3b9f5432f5782b62d8cfd5247d5ee71sha1
07d889e2dadce6f3910dcbc253317d28ca61c766sha1
http://sfrclak.com:8000/url
http://sfrclak.com:8000/6202033url
142.11.206.73ipv4
static-www.elastic.codomain
packages.npm.orgdomain

Original source: https://www.elastic.co/security-labs/blog/axios-supply-chain-compromise-detections