Electronnodejs Outbound Connection From Unusual Appdata Path

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•0•0•2

Detects outbound network connections initiated by Electron or Node.js processes that are launched from non-standard subdirectories within the AppData\Local path. This rule specifically excludes common legitimate applications like Microsoft programs, Slack, and Discord. The detection aims to identify potentially malicious Electron or Node.js applications attempting C2 communication or other unauthorized network activity from an unexpected location.