NodeInitRAT Persistence via Registry Key
Detects instances where NodeJS (node.exe) spawns the Command Processor (cmd.exe) to execute the 'reg add' command. This behavior is a known persistence technique used by the NodeInitRAT backdoor, associated with the Mocha Manakin threat actor, to add a run key to the Windows Registry.
Sigma
