Miasma: node.exe Enumerating Security Tools or Reading EDR Registry Keys Pre-Payload
Detects instances where a 'node.exe' process spawns common reconnaissance utilities (tasklist.exe, wmic.exe, sc.exe) or attempts to access registry keys associated with security software (e.g., CrowdStrike, SentinelOne, Windows Defender). This behavior is indicative of a Node.js-based application potentially being leveraged as a platform for post-exploitation activities, such as environment discovery or tampering with security controls.
Cortex XDR
