CVE-2026-111497 PoC script driving node with Brotli decompression probes
Detects execution of a Python proof-of-concept script targeting CVE-2026-111497 that launches node child processes or runs related commands involving Brotli compression files and decompression functions.
Microsoft Sentinel (KQL)

