Node.js Spawns Child Process Followed by Startup Persistence Write
Detects instances where node.js or npm processes spawn child processes that subsequently perform write operations into Windows startup folders or registry run keys within a one-hour window. This behavior is indicative of a second-stage payload execution and persistence mechanism often leveraged by threat actors.
Microsoft Sentinel (KQL)
