Backdoor Software Inventory Enumeration via PowerShell

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•1•0•8

Detects PowerShell commands executed by a Node.js process to gather system information, specifically targeting installed applications and packages. This could indicate malicious activity where a Node.js application or script is being used to enumerate system details.