Batch file dropped in Startup folder relaunching EXE/INI pair
Detects the creation or execution of suspicious .bat files within the Windows Startup folder, often coupled with command-line arguments involving .ini files. This behavior is indicative of persistence mechanisms where adversaries leverage the startup folder to ensure malicious scripts run upon user logon.
Microsoft Sentinel (KQL)
