DeadVax Batch Staging in temp
When a user opens a fake document in this attack, the document runs a script in the background. That script creates a batch file in a hidden temp folder. The folder structure is unusual: a temp folder inside another temp folder. The batch file has a random-looking name. Normal programs rarely create batch files in this way. Legitimate installers might use temp folders, but they do not typically create nested temp paths with batch files. The script that creates this file is started by the document, not by the user. Security teams should look for batch files being written to this specific path by a script process. This rule helps catch that staging step before the malware runs.
Sigma
