Node.js executing protocal.cjs spawning reconnaissance processes

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•7

Detects instances where 'node.exe' executes 'protocal.cjs' from 'NodePackages' paths, subsequently spawning child processes that perform host reconnaissance activities. This includes PowerShell commands querying registry keys related to installed software or listing applications.