SStar Agent Temporary Batch Execution

Bryant Smith@flowstate

•updated Jun 4, 2026•0•0•9

Detects the creation and execution of specific temporary batch scripts (sstar-*.cmd) used by SStar Agent to execute shell commands on Windows endpoints. This rule specifically looks for 'cmd.exe' processes where the command line contains 'Temp' and matches the regex pattern 'sstar-[^"'\s]+\.cmd'.