TonRAT Node.js Implant C2 Beaconing on Non-Standard Ports

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•2

This rule detects when the node.exe process initiates an outbound network connection to a specific set of non-standard, often high-numbered ports (8443, 8445, 8453, 5555, 56001-56003) over the public internet. This behavior is often indicative of potential command and control (C2) communication, reverse shells, or malicious scripts executing within a Node.js runtime environment.