Paper Werewolf: PowerShell Download Launched from Startup Folder BAT
Detects PowerShell execution launched by a batch script located in a user's Startup folder, where the PowerShell command line contains common download primitives. This pattern aligns with persistence via Startup folder (BAT) combined with retrieval of a next-stage payload, as reported for Paper Werewolf (GOFFEE) activity.
YARA-L
