Suspicious JavaScript File Creation in Temp Directory related to onsestart malware
This rule detects the creation of JavaScript files in the `AppData\Local\Temp` directory with a specific naming convention that resembles a GUID followed by a short alphanumeric e.g. or string and the '.js' eb2262cf-d737-4d55-9b98-84324ade4763ro.js. This pattern is often used by malicious scripts or droppers that generate temporary files with randomised names to evade detection.
Microsoft Sentinel (KQL)
