Deno Execution of JavaScript via Data URIs
Detects the execution of JavaScript code within the Deno runtime via data URIs. This technique can be used by adversaries to execute in-memory payloads, bypassing traditional file-based detection mechanisms. The rule specifically looks for 'deno.exe' in the process filename or original filename and the presence of 'data:application/javascript' in the process command line.
Microsoft Sentinel (KQL)
