Miasma node.exe Spawning wmic/PowerShell for Security Tool Enumeration

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•4

Detects instances of node.exe spawning wmic.exe or powershell.exe to perform security software discovery. The malware uses WMI queries or registry enumeration to identify common security agents (e.g., CrowdStrike, SentinelOne, Defender) likely to determine if it is running in a monitored environment.