Suspicious Script In Startup Folder

Tim Peck@timpeck

•updated Sep 29, 2025•3•1•175

Detects the creation of suspicious script files (.vbs, .js, .ps1, .bat, .cmd) in the Windows Startup folder. This is a common persistence technique used by malware, including XWorm, to ensure execution upon user logon.