Node.js process spawns disguised native binary intro.js as child process
Detects the execution of a file named 'intro.js' by the Node.js runtime located within a 'node_modules' directory. This pattern is often associated with the execution of suspicious scripts, persistent backdoors, or malicious packages that attempt to masquerade as standard dependencies.
Microsoft Sentinel (KQL)
