TonRAT Node.js Registry Persistence via Run/RunOnce Keys
Detects the TonRAT malware establishing persistence by writing node.exe or JavaScript file paths into Windows registry Run or RunOnce keys. This activity, often involving paths within AppData or ProgramData, is a common indicator of persistence mechanisms used by TonRAT, as observed in the Photo ZIP hospitality campaign.
Microsoft Sentinel (KQL)
