Batch script creates fake 'Documento indisponivel' decoy invoice file
Detects the creation of a file named 'NF-eletronica.txt' that contains the text 'Documento indisponivel' via cmd.exe. This pattern is indicative of a security researcher or adversary deploying a canary or decoy file to monitor for unauthorized access or to plant deceptive content.
Sigma
