TonRAT Node.js Registry Run Key Persistence on Hospitality Workstations
Detects the creation or modification of Windows Registry Run keys that point to Node.js related files or JavaScript/module scripts, specifically excluding those signed by Microsoft or the OpenJS Foundation. This is a common technique used by attackers to maintain persistence by executing scripts automatically upon user logon.
SentinelOne
