TONResolver RAT PowerShell BigInteger Obfuscation Dropper Downloading Next-Stage PS1

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects suspicious PowerShell command-line activity characterized by the use of execution policy bypass flags, obfuscated strings referencing BigInteger or character manipulation, and the potential retrieval of malicious scripts from temporary directories.