TonRAT Registry Run Key Persistence via node.exe on Hospitality Systems
Detects the creation or modification of Windows Registry Run keys that point to potential Node.js applications or scripts. This is a common persistence technique where attackers configure malicious scripts to execute upon user logon or system startup.
Microsoft Sentinel (KQL)
