Renamed Node.js Binary Execution

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the execution of a renamed Node.js JavaScript runtime, normally named "node.exe". Node.exe is the executable file for the Node.js JavaScript runtime and is typically used to execute JavaScript code outside a web browser environment. Threat actors may rename the Node.js executable to a random name to run malicious scripts stealthily.

2026-08-26 00:00:00

None

4b965ef5-e76c-4410-8c75-d12c8c3c8e28

attack.execution attack.t1059.007

Nextron Sigma feed only (private)