Script Interpreter Execution From Suspicious Folder (via process_creation)

This rule detects anomalous script execution from anomalous directories or folders accessible by environment variables that may indicate malware activity. Script interpreters (cscript, wscript, mshta, powershell) running from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute hostile scripts.