TONResolver Node.js Downloaded by PowerShell Executing JS RAT Payload
This rule detects potentially malicious activity related to the deployment and execution of Node.js. It monitors for PowerShell commands downloading or extracting Node.js archives from official source paths, as well as instances where node.exe is spawned by office applications (Word, Excel, Outlook) or PowerShell, which is highly abnormal in standard production or end-user environments.
Splunk (SPL)
