Batch File Launches Malicious Executable
Detects the execution of a batch file from a common user directory (e.g., Downloads, Desktop) that immediately launches an executable file. This pattern was observed in a Webrat malware campaign where a `start_exp.bat` file was used to launch the primary malicious payload, `rasmanesc.exe`, tricking users into running it after extracting a fake exploit archive.
Sigma
