TONResolver RAT Node.js Installation via PowerShell to AppData\Local\Nodejs
Detects PowerShell execution involving Node.js related artifacts such as downloads from nodejs.org, extraction of specific Node.js archive versions, or interaction with Node.js installation directories. This activity is indicative of potential unauthorized software installation or preparation for execution of Node.js-based applications or tools on a Windows system.
Cortex XDR
