Adwind RAT / JRAT Execution from AppData or Script Execution
Detects the execution of javaw.exe from an AppData folder, which is a known behavior of Adwind RAT (also known as jRAT). Additionally, it detects the execution of cscript.exe with specific command-line arguments related to 'Retrive.vbs', which could indicate further malicious activity or a different variant/stage of the attack.
Sigma
