Node.js or Bun spawning shell child process (Node2Shell Brotli RCE, CVE-2026-111
Detects post-exploitation behavior where a Node.js, Node, or Bun runtime spawns a Unix shell process (such as sh, bash, or dash) with command line arguments indicative of code execution, reverse shells, or download tools (e.g., -c, /dev/tcp, mkfifo, curl, wget, nc, base64).
Microsoft Sentinel (KQL)
