Node.js Execution of JavaScript File
Detects the execution of JavaScript or JSC files using the Node.js binary (node.exe). This activity can be suspicious as adversaries have been observed abusing Node.js to disguise malware, evade security defenses, and maintain persistence. While Node.js is commonly used, unusual occurrences of this activity in an environment warrant immediate investigation.
Sigma
