Anomalous execution of node.exe on endpoint

Renata Cardoso@rcardososec

•updated Aug 10, 2026•2•0•5

Detects execution of node.exe, which may indicate anomalous LOLBin/runtime usage on endpoints where Node.js is not an authorized business tool