node.exe Spawning System Reconnaissance Commands (Polymarket Trap / Miasma)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects instances where Node.js or NPM processes initiate common Windows discovery tools (e.g., systeminfo, whoami, tasklist, ipconfig, wmic). This behavior is often indicative of post-exploitation discovery or reconnaissance activity performed by an adversary utilizing an application or malicious script running within the Node.js runtime environment.