Node.js executing protocal.cjs spawning reconnaissance processes
Detects instances where 'node.exe' executes 'protocal.cjs' from 'NodePackages' paths, subsequently spawning child processes that perform host reconnaissance activities. These activities include PowerShell registry queries and process listing commands, indicative of potential malicious behavior.
Microsoft Sentinel (KQL)
