ChainScript node-pty spawns interactive cmd/powershell from node.exe

Kaung Khant Ko@kaungkhantko

•updated Sep 21, 2026•2•0•5

This rule detects suspicious activity where a node.exe process, often associated with a node-pty terminal emulation, launches common Windows command-line shells (cmd.exe, powershell.exe) from specific file paths or directories. This behavior is indicative of a Node.js-based Remote Access Trojan (RAT) or shell spawning mechanism being used to establish command and control or persistence on a Windows host.