TONResolver node.exe WebSocket beacon with system_info type:4 JSON

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects malicious activity associated with the TONResolver RAT, specifically the initiation of a system reconnaissance beacon containing host information and the establishment of registry-based persistence. The rule monitors for a node.exe process residing in a specific AppData path performing network communication and registry modifications to the HKCU Run key.