Title:Node Process Executions Status:test Description:Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud References: -https://twitter.com/mttaggart/status/1511804863293784064 Author: Max Altgelt (Nextron Systems) Date: 2022-04-06 modified:None Tags:
-'attack.execution'
-'attack.stealth'
-'attack.t1127'
-'attack.t1059.007'
Logsource:
category: process_creation
product: windows
Detection: selection: Image|endswith:
'\Adobe Creative Cloud Experience\libs\node.exe' filter: CommandLine|contains:
'Adobe Creative Cloud Experience\js' condition:selection and not filter Falsepositives:
-Unknown Level:medium
