VoidGeist Startup Batch Persistence
This rule detects the creation of specific batch files ("non.bat" or "spol.bat") within the Windows Startup folder (`\Microsoft\Windows\Start Menu\Programs\Startup`). This activity is indicative of persistence, as files placed in this location will execute automatically when a user logs in, potentially associated with the VoidGeist malware chain.
Microsoft Sentinel (KQL)
