Node.js Accessing Browser Extension LevelDB or Suspicious Command Line
Detects instances where 'node.exe' accesses browser extension LevelDB directories for Chrome, Edge, or Brave, or executes with suspicious command-line arguments such as 'protocal.cjs', 'NodePackages', or 'nvmconf'. This behavior can indicate attempts to exfiltrate sensitive browser data or establish persistence, potentially associated with supply chain attacks or backdoors.
Microsoft Sentinel (KQL)
