clientCode RAT execution spawned from Node.js parent process
Detects the execution of the 'clientCode' RAT process when initiated by a Node.js process (node.exe/node). This behavior is indicative of a second-stage payload execution related to supply chain compromises where malicious dependencies are leveraged to gain remote shell access.
Microsoft Sentinel (KQL)
