Low-level keyboard hook by Node.js in temp/appdata (JSCeal keylogger)
Detects when a Node.js process initiates a low-level keyboard hook (WH_KEYBOARD_LL or WH_KEYBOARD) while running from common user-writable directories, which may indicate malicious keylogging activity by a suspicious process.
Microsoft Sentinel (KQL)
