TonRAT node.exe Spawned by PowerShell with Non-Standard Port C2

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•0

Detects potentially malicious activity involving the node.exe process. The rule identifies suspicious parent processes (PowerShell, cmd.exe, explorer.exe, wscript.exe), execution from non-standard user-writable directories (e.g., AppData, Temp), and network connections over non-standard C2 ports typically associated with TonRAT behavior.