Potential EmpireMonkey Activity
This rule detects potential activity associated with the EmpireMonkey APT group. Specifically, it looks for process creation events where the command line contains both '/e:jscript' and '\Local\Temp\Errors.bat'. This combination suggests the execution of a JScript file, possibly a malicious script, from a temporary directory, which is a common tactic used by threat actors for defense evasion and execution.
Sigma
