Potentially Suspicious Shell Script Creation in Profile Folder
Detects the creation of shell scripts (files ending with .csh or .sh) within the '/etc/profile.d/' directory. This directory is used to store shell scripts that are executed when a user logs in, making it a common target for adversaries to establish persistence or elevate privileges.
Sigma
