TONResolver CVE-2026-33017: mshta/wscript→PowerShell→node.exe Run Key Persistence

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•7

This rule detects potential exploitation of vulnerabilities (such as CVE-2026-33017) where mshta.exe or wscript.exe spawns PowerShell, followed by the addition of a persistent entry to the HKCU Run registry key targeting Node.js or JavaScript files.