Node.js Reconnaissance from NodePackages Path
Detects instances where 'node.exe' executes 'protocal.cjs' from a 'NodePackages' path and subsequently spawns child processes that perform host reconnaissance activities. These activities include PowerShell registry queries, process listing, and querying installed applications, which are indicative of an adversary gathering system information.
Microsoft Sentinel (KQL)
