Possible NodeJS Execution of JavaScript File (via process_creation)

title: Possible NodeJS Execution of JavaScript File (via process_creation)
id: 1a5ab7a1-10b3-537d-b90d-db9ecc2768ff
status: stable
description: This rule detects execution of JavaScript or JSC files using NodeJs binary node.exe, that could be potentially suspicious. Node.js is a popular open-source JavaScript runtime that runs code outside browsers and is widely used for both frontend and backend development. Adversaries have been observed abusing Node.js to disguise malware as legitimate processes, evade security defenses, and maintain persistence within target systems. Because Node.js is frequently used, this rule may generate false positives in some environments. However, if such behavior is unusual in your environment, it is highly anomalous and warrants immediate investigation.
references:
    - https://attack.mitre.org/techniques/T1059/007/
    - https://www.microsoft.com/en-us/security/blog/2025/04/15/threat-actors-misuse-node-js-to-deliver-malware-and-other-malicious-payloads/
author: Huntrule Team
date: 2026-01-02
tags:
    - attack.execution
    - attack.t1059.007
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\node.exe'
        - OriginalFileName: 'node.exe'
        - Product: 'Node.js'
    selection_cmd:
        CommandLine|contains: '.js'
    condition: all of selection_*
falsepositives:
    - Unknown
level: low