Suspicious NeutralinoJS Framework Execution from Non-Standard Directory
Detects the execution of NeutralinoJS framework components ('neutralino.exe', 'node.exe') from non-standard directories. This behavior is associated with the EvilAI campaign, where threat actors leverage the NeutralinoJS framework to execute arbitrary JavaScript code for covert data access and process spawning. The detection specifically looks for the '--load-dir-res' argument, which is a strong indicator of a NeutralinoJS application launch, and filters out executions from standard application installation directories to focus on anomalous locations, which can indicate malware masquerading as a portable app or running from a temporary/user location.
Microsoft Sentinel (KQL)
