Xworm Hidden Batch File Execution

Tim Peck@timpeck

•updated Nov 13, 2025•5•0•66

Detects the creation and subsequent hidden execution of a batch file, a technique used by XWorm to stage malicious code. The rule looks for a .bat file created in a temporary or user profile directory, which is then immediately run invisibly using the 'cmd /c start "" /min' command.