TONResolver Node.js Persistence via Registry Run Key in AppData
This rule monitors for modification of Windows Registry Run keys (a common persistence mechanism) by node.exe or powershell.exe, specifically targeting paths related to local Node.js installations. This behavior is indicative of an adversary attempting to establish persistence by setting an executable to run automatically upon user logon.
Splunk (SPL)
