Miasma/MYRA infostealer shell history collection via peer-math.js
Detects Node.js processes accessing common shell history files (e.g., .bash_history, .zsh_history, PowerShell history). Such behavior is often indicative of credential harvesting or post-exploitation reconnaissance activity, specifically where a Node.js runtime environment is being leveraged to read sensitive user activity logs.
Splunk (SPL)
