VBS Script Creating Startup Folder Shortcut
Detects the execution of VBS scripts (wscript.exe or cscript.exe) that interact with the Windows Startup folder to create shortcuts. This behavior is associated with persistence mechanisms where malicious scripts create masqueraded shortcuts (e.g., SecurityHealth, OneDriveUpdate) in the user's Startup folder, often using hidden attributes to evade detection.
Cortex XDR
