Suspicious Inline JavaScript Execution via NodeJS
Detects potentially suspicious inline JavaScript execution using the Node.js binary. The rule specifically looks for the execution of 'node.exe' combined with command-line arguments that contain keywords indicative of malicious activity, such as 'http' (for network communication), 'execSync' or 'spawn' (for executing system commands), 'fs' (for file system operations), 'path', and 'zlib' (often used in unpacking or data manipulation). This combination suggests an attempt to execute arbitrary code or perform system interactions via Node.js.
Sigma
