TonRAT Photo ZIP: PowerShell spawns node.exe from user-writable path via LNK
Detects the execution sequence associated with TonRAT malware, including the launching of PowerShell from explorer.exe via malicious LNK files (often disguised as photo or image files) and the subsequent execution of a node.exe process from user-writable directories such as AppData or Temp.
Microsoft Sentinel (KQL)
