MuddyWater Node.js Spawning SentinelOne Scanner
Detects Node.js orchestrating the SentinelOne memory scanner for evasion and targeted DLL sideloading. This behavior is indicative of an adversary attempting to use legitimate tools in an unexpected way, potentially to bypass security controls or perform malicious actions under the guise of a trusted process.
Microsoft Sentinel (KQL)
