Node/Metro server spawning cmd.exe running encoded PowerShell with Defender exclusions

ills3c Intel&Coffee@Ills3C

•updated yesterday•1•0•4

Detects potential exploitation of CVE-2025-11953 (Metro4Shell) where a Node.js development server spawns a command shell executing an encoded PowerShell command. The PowerShell script performs defense evasion via Windows Defender exclusions (Add-MpPreference), downloads a payload over raw TCP sockets (System.Net.Sockets.TcpClient), and executes it using Start-Process.