This analytic flags Windows hosts when node.exe directly executes a single .js file located in the same directory from which the Node.js process was launched, and that directory is an unusual location (PerfLogs, ProgramData, Temp, or a user folder). Legitimate Node.js directories (e.g., AppData Roaming, node installations, nvm, AppData Local) are excluded to reduce false positives. The pattern often indicates malware loaders or second-stage payloads using the Node.js runtime to run JavaScript outside of typical development or application contexts. Detection relies on endpoint telemetry to correlate process creation and command-line activity: node.exe must run a .js file, the script path must be in the same directory as the process’s current working directory, the process path should reside in an unusual location, and the invocation typically involves two arguments (node and the script). When matched, the rule surfaces a finding with the destination host, involved processes, script name, and parent process lineage to facilitate investigation of loader activity and potential post-exploitation behavior.