JScript Copy to Startup Folder
Identifies a Windows Script Host process (wscript.exe or cscript.exe) creating a JScript (.js) file in a Startup folder. This is a common persistence technique used by malware, including the JScript downloader in the Remcos RAT campaign.
Microsoft Sentinel (KQL)
