Fake 'Network Connection Dump Snapshot' diagnostic log written by npm-spawned process
Detects Node.js processes generating text or log files containing diagnostic markers related to network activity monitoring, such as 'Network Connection Dump Snapshot' or 'Monitoring active egress sockets'. This behavior is characteristic of custom tool execution used for network discovery and data collection on a host.
Microsoft Sentinel (KQL)
