Node-RED spawning shell with base64 decode to sh or /dev/shm dropper
Detects Node-RED processes spawning Unix shells to execute base64-decoded commands or downloading and executing hidden payloads via /dev/shm.
Microsoft Sentinel (KQL)
Detects Node-RED processes spawning Unix shells to execute base64-decoded commands or downloading and executing hidden payloads via /dev/shm.
Already have an account?