host recon via node.exe from NodePackages

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•8•0•20

Detects instances where 'node.exe' executes 'protocal.cjs' from 'NodePackages' paths, subsequently spawning child processes that perform host reconnaissance activities. This includes PowerShell commands for registry queries, installed application enumeration, and process listing, which are indicative of malicious discovery.