ChainScript agent spawns cmd.exe /c from node.exe (cmd task)

Kaung Khant Ko@kaungkhantko

•updated Sep 21, 2026•1•0•4

This rule detects when the Node.js runtime process (node.exe) initiates the Windows command interpreter (cmd.exe) with the '/c' flag, which is commonly used to execute commands or scripts. This behavior is frequently associated with malicious Node.js activity, such as Remote Access Trojans (RATs) or web shells, which may use the shell to execute system-level operations or bypass typical application constraints.