Suspicious Child Process of Node.js or Next.js Server
Detects the creation of suspicious child processes (e.g., shells, network tools) by a Node.js or Next.js server process. This could indicate successful remote code execution, potentially related to vulnerabilities like React2Shell (CVE-2025-55182).
Microsoft Sentinel (KQL)
