Batch script renames windowSysUpdates.txt to GymTraniningShedule.exe in SystemFo

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•0

This rule detects potentially malicious file manipulation activities, such as renaming, moving, copying, or deleting files, specifically when involving targeted filenames (e.g., 'GymTraniningShedule.exe') or locations (e.g., 'SystemFolder32'). The detection monitors for suspicious command-line arguments executed by 'cmd.exe' or 'conhost.exe' and cross-references them with file deletion events involving '.lnk' files or specific application artifacts.