TONResolver RAT: node.exe spawned by unusual parent for JS payload execution
Detects suspicious execution chains where common Windows scripting hosts (powershell.exe, cmd.exe, wscript.exe, etc.) spawn node.exe to run JavaScript files from user-writable directories (Temp, AppData, etc.). The rule flags execution patterns often associated with the TONResolver RAT, including specific PowerShell encoding or cryptography patterns and node.js scripts running from non-standard application paths.
Microsoft Sentinel (KQL)
