Suspicious Execution of Visual Studio NodejsTools PressAnyKey Arbitrary Binary (via process_creation)

title: Suspicious Execution of Visual Studio NodejsTools PressAnyKey Arbitrary Binary (via process_creation)
id: fca2e9f5-09c0-51c9-a87f-227c7df4c24c
status: stable
description: This rule detects child processes of Microsoft.NodejsTools.PressAnyKey.exe that can be leveraged to execute any other binary
references:
    - https://attack.mitre.org/techniques/T1218/
    - https://twitter.com/mrd0x/status/1463526834918854661
    - https://gist.github.com/nasbench/a989ce64cefa8081bd50cf6ad8c491b5
author: Huntrule Team
date: 2026-03-12
tags:
    - attack.execution
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\Microsoft.NodejsTools.PressAnyKey.exe'
    condition: selection
falsepositives:
    - Unknown
level: medium