Fake Node.js installer batch: PowerShell WebClient download to TEMP and RunAs la

Adarsh Pandey@Pandeyadarsh

•updated today•0•0•1

Detects PowerShell execution spawned by a batch script (cmd.exe) that performs a file download into a temporary directory using WebClient and subsequently launches the downloaded executable using Start-Process with the runas verb within a 10-minute window.