Suspicious Script Creation in Windows Startup Folder
Detects the creation of batch or command scripts in the Windows Startup folder. This is a common persistence technique used by malware like VOID#GEIST (spol.bat) to ensure execution on user logon. The rule specifically looks for file creation events of .bat or .cmd files in the Startup folder, initiated by processes commonly associated with malicious downloads or script execution such as cmd.exe, powershell.exe, curl.exe, cscript.exe, and wscript.exe.
Microsoft Sentinel (KQL)
