Windows Node.exe Executing JS Script In Immediate Folder — Detection Rule
The following analytic identifies `node.exe` directly executing a single `.js` script located in the same directory it was launched from, where that directory is an unusual location such as a user profile, PerfLogs, ProgramData, or Temp folder. Legitimate Node.js application, module, and package manager directories are excluded. This pattern is commonly associated with malware loaders and second-stage payloads that leverage the Node.js runtime to execute JavaScript outside of a typical development or application context.