Node.js process spawning shell or utilities (Node2Shell CVE-2026-111497 post-exp
Detects post-exploitation behavior where a Node.js process spawns a shell, interpreter, or utility (such as sh, bash, nc, curl, python), which may indicate Remote Code Execution (RCE) via vulnerabilities like CVE-2026-111497 in the Node.js Brotli decoder.
Microsoft Sentinel (KQL)
