Miasma/MYRA node.exe reading SSH private keys from developer workstation
Detects instances where the node.exe process attempts to read SSH configuration files or private key files (id_rsa, id_ed25519, etc.). This behavior is often associated with malicious packages or compromised scripts attempting to exfiltrate SSH credentials from the local file system. The rule includes exclusions for common node package manager installation paths and processes that appear to be performing legitimate package management or post-installation tasks.
Microsoft Sentinel (KQL)
