Node Process Executions Outside Adobe Creative Cloud JS Directory
This rule detects the execution of the Node.js executable that is bundled with Adobe Creative Cloud, specifically when it is used to execute scripts outside of the legitimate 'Adobe Creative Cloud Experience\js' directory. This behavior can indicate an adversary attempting to leverage a trusted application's bundled interpreter for malicious script execution, potentially bypassing application control or whitelisting solutions.
Sigma
