Visual Studio NodejsTools PressAnyKey Renamed Execution
Detects renamed execution of "Microsoft.NodejsTools.PressAnyKey.exe", which can be abused as a LOLBIN to execute arbitrary binaries. This technique is often used for defense evasion by proxying execution of malicious content with a trusted, signed binary.
Sigma
