TonRAT: PowerShell LNK Spawning node.exe from User-Writable Path
This rule detects potentially malicious process chains: first, where common Windows utilities like explorer.exe, mshta.exe, or cmd.exe spawn PowerShell with suspicious arguments (hidden windows, execution policy bypass, or encoded commands). Second, it detects when Node.js is executed from user-writable directories (Temp, AppData, Downloads, ProgramData) by PowerShell or explorer.exe, excluding legitimate nodejs installation paths. These patterns are often associated with dropper behavior or initial access stages.
Cortex XDR
