Evil Ai Nodejs Malicious Execution
Detects the execution of a malicious Node.js payload, a technique used by the EvilAI malware campaign. EvilAI launches node.exe via cmd.exe to run a JavaScript file from the user's temporary directory. The script name follows a specific pattern (GUID followed by 'or', 'ro', or 'of').
YARA-L
