TonRAT Registry Run Key Persistence via node.exe Writing to HKCU\Run
Detects the modification of Windows Registry run keys by node.exe. This activity is often used by adversaries to establish persistence, where a malicious Node.js script or application is set to automatically execute upon user logon.
Cortex XDR
