High RiskWindowsLegitimateCommonly Abused
node.exeRUNTIME ENVIRONMENTnode.exe - Node.js Runtime Security Analysis
node.exe is the **Node.js JavaScript runtime**. Attackers abuse Node.js for **script-based attacks**, **C2 frameworks**, and leveraging npm packages for exploitation. Many Electron apps include node.exe, making it common on systems. Unexpected node.exe execution warrants investigation.
Risk Summary
HIGH priority for SOC triage. node.exe can execute arbitrary JavaScript with system access. Monitor for node.exe from unexpected locations, spawning suspicious child processes, or executing obfuscated code.
Overview
What is node.exe?
Node.js is a JavaScript runtime built on Chrome's V8 engine.
Core Functions
JavaScript Execution:
- Server-side JavaScript
- Build tools and scripts
- Desktop apps (Electron)
Security Significance
- Code Execution: Full system access
- npm Ecosystem: Supply chain risks
- Electron Apps: Bundled with many apps
- Attack Framework: C2 tools use Node
Normal Behavior
Normal Behavior
Expected Process State
| Property | Expected Value |
|---|---|
| Path | C:\Program Files\nodejs\node.exe or app-specific |
| Parent | cmd.exe, IDE, or parent app |
| User | Developer or app account |
| Context | Development, app runtime |
Common Locations
C:\Program Files\nodejs\node.exeVarious Electron app locationsSuspicious Indicators
Legitimate vs Suspicious
LEGITIMATE
Path: C:\Program Files\nodejs\node.exe
Within Electron app
Parent: IDE, known application
Context: Development
SUSPICIOUS
Path: C:\Temp\node.exe
C:\Users\Public\node.exe
Parent: cmd.exe from unknown source
Context: Non-development machine
Behavior: Network C2, spawning shells
Abuse Techniques
Attack Techniques
Technique #1: Script-Based Attack (T1059.007)
Execute Malicious Script:
node.exe malware.js
node.exe -e "require('child_process').exec('calc.exe')"
Technique #2: npm Supply Chain (T1195.002)
Malicious npm packages executed via node.
Technique #3: C2 Framework
Node.js-based C2 tools.
Detection Guidance
Detection Strategies
Priority #1: Suspicious Location
Process = "node.exe" AND
Path CONTAINS ["%TEMP%", "\Public\", "\AppData\Local\Temp\"]
→ ALERT: HIGH
Priority #2: Inline Execution
Process = "node.exe" AND
CommandLine CONTAINS "-e "
→ ALERT: HIGH - Inline code execution
Priority #3: Shell Spawning
ParentProcess = "node.exe" AND
ChildProcess IN ["cmd.exe", "powershell.exe"]
→ ALERT: HIGH
Remediation Steps
Protection and Remediation
Defense: Application Control
Whitelist specific node.exe paths.
If Compromise Suspected
- Identify the script executed
- Check for C2 activity
- Review npm packages
- Analyze network connections
Investigation Checklist
Investigation Checklist
- Verify node.exe path
- Check command line for scripts
- Look for inline execution (-e)
- Review child processes
- Check network connections
MITRE ATT&CK Techniques
Last verified: January 18, 2026