VoidGeist Batch Script Persistence in Startup Folder
This rule detects the creation of specific batch files, 'spol.bat' or 'non.bat', within the Windows Startup folder. This activity is indicative of persistence, as these files will execute automatically when a user logs in, allowing an attacker to re-establish control or continue malicious operations. The rule specifically targets these filenames and the Startup folder path to reduce false positives and focus on a known persistence mechanism used by the VoidGeist threat chain.
Sigma
