Startup Script Written to Remote Host via SMB

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects the writing of a file containing both the string "Startup" (case-insensitive) and the string ".bat" (case-insensitive) to a remote host via the Server Message Block (SMB) protocol on port 445. This activity is indicative of an attempt to establish persistence by creating a startup script on a remote system.