Node CLI invocation spawns embedded native payload outside npm install lifecycle
This rule monitors for direct execution of Node.js binaries (node.exe or node) where the target script or binary is located within a 'node_modules' directory. By excluding standard file extensions (.js, .mjs, .cjs, .json) and common npm installation command lines, the rule aims to identify potentially malicious or non-standard binaries being executed in a context often used by adversaries for persistence or lateral movement within software dependency environments.
Microsoft Sentinel (KQL)
