Script File Dropped in Startup Folder
This rule detects the creation of script files (batch, VBS, JS, PowerShell, or shortcut files) within Windows Startup folders. It monitors both user-specific and all-users startup locations. The primary purpose is to identify persistence mechanisms where an attacker or malicious software places a script to execute automatically when the system or user logs on.
Sigma
