Mastra NPM - Node Execution with Specific Attacker IP Arguments
Detects node.exe launching with hardcoded easy-day-js C2 IP and port combinations passed as command-line arguments, indicative of the Mastra NPM supply chain compromise.
Microsoft Sentinel (KQL)
