Suspicious Batch File Execution for Ransomware-like Activity

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•2

This rule detects suspicious command-line activity involving `cmd.exe` or `powershell.exe` executing batch files (`.bat`, `.cmd`) or using the `/c copy` command, specifically when targeting common drive letters (C:, D:, E:) and explicitly excluding commands that contain 'recover', 'restore', or 'decrypt'. This pattern is often observed in ransomware operations attempting to encrypt or manipulate files on local drives.