Node.js web server spawning shells or download tools (Node2Shell Brotli RCE)

Suraj A@cytech

•updated yesterday•23•0•35

Detects a Node.js web server process initiating a child process that is a known command shell or download utility, which is indicative of post-exploitation activity such as remote code execution.