Suspicious Batch File Creation
This rule detects suspicious batch (.bat) file creation events by monitoring for several indicators. It flags batch files created by processes using command lines indicative of downloads (e.g., 'http:', 'https:', 'iwr', 'iex', 'invoke'), batch files created by suspicious executables ('curl.exe', 'mshta.exe'), batch files placed in high-risk directories ('\Users\Public\', '\Start Menu\Programs\Startup\'), or batch files exceeding a size threshold of 5MB. The rule explicitly excludes processes named 'java.exe' or 'javaw.exe' from triggering alerts.
Sigma
