Miasma/MYRA node.exe Reading Shell History Files for Credential Exfiltration
Detects the node.exe process attempting to read shell history files (.bash_history, .zsh_history, etc.), which are common targets for credential harvesting by malicious npm packages. This behavior is associated with the Polymarket Trap campaign involving Miasma and MYRA infostealers.
Microsoft Sentinel (KQL)
