Suspicious Node.js Execution (Tsundere Bot)

g host@ghosty

•updated Jan 28, 2026•16•1•114

Detects the anomalous execution of Node.js from non-standard, user-writable directories or when spawned by a shell process. This behavior is indicative of the Tsundere Bot backdoor, often used by TA584. The rule specifically looks for node.exe running from common user-writable or temporary directories (AppData\Local, Users\Public, Temp) or when initiated by command-line shells like powershell.exe or cmd.exe.