ChainScript node.exe spawning cmd/PowerShell via wra-ps temp scripts

Ibrahim Saud@tektrix

•updated Sep 22, 2026•1•0•6

Detects instances where a Node.js process (node.exe) initiates command-line interpreters (cmd.exe, powershell.exe) with specific arguments or command lines associated with administrative or potentially obfuscated/automated script execution. This is a common pattern for post-exploitation activities or legitimate administrative automation.