TonRAT - PowerShell Spawned from LNK Shortcut Downloading Node.js Runtime
Detects suspicious PowerShell command lines associated with the TonRAT implant, which is distributed via .lnk shortcut files. The rule identifies obfuscated PowerShell execution spawned by shortcut files, the download of Node.js runtimes from external sources, and the staging of obfuscated JavaScript payloads in temporary directories.
Microsoft Sentinel (KQL)
