Node.js process invoking node:zlib Brotli decompression functions (CVE-2026-1114
Detects process execution of Node.js or Bun where inline scripts or command-line arguments utilize Brotli decompress functions from the zlib library.
Microsoft Sentinel (KQL)

