Affair-Build Script Restarting VDS
This rule detects the execution of `cmd.exe`, `powershell.exe`, or `pwsh.exe` that includes the command-line arguments related to an 'affair-build.bat' script or directly stopping/starting the Virtual Disk Service (VDS) using `net` or `sc` commands. It aims to identify cleanup or persistence script sequences that manipulate the VDS.
Cortex XDR
