Node.js Spawns Detached Child Referencing sharedLoad.min.js (indexed-btree)

Ibrahim Saud@tektrix

•updated 15 days ago•0•0•3

Detects Node.js process executions that involve loading a suspicious JavaScript file named 'sharedLoad.min.js' or 'extended/sharedLoad.min.js'. The rule further flags instances where the process command line includes 'detached' and 'windowsHide' arguments, which are frequently used to execute Node.js scripts in the background without a visible window.