BTR_CLI.exe execution with action-based CLI syntax

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•3

Detects execution of the BTR_CLI.exe utility with specific command-line arguments. The flags monitored include -a, -chain, -item, -trigger, and -cleanup, which suggest administrative, chaining, or automated triggering behaviors of a custom or proprietary command-line interface tool. This rule tracks the command-line usage to identify potential automated task execution or system configuration changes.