Persistence via PowerShell Download to Startup Folder

Elgonad .@elgonad

•updated Jan 13, 2026•13•1•144

Detects PowerShell downloading a batch file (.bat) into the user's Startup folder. This is a common persistence technique (T1547.001) and was observed in an AsyncRAT campaign where the payload was downloaded from a malicious `trycloudflare.com` domain.