Suspicious Startup Folder Persistence (via file_event)

This rule detects the creation of potentially hostile script and executable files in Windows startup folders, which is a common persistence method used by threat actors. These files (.ps1, .vbs, .js, .bat, etc.) are automatically executed when a user logs in, making the Startup folder an attractive target for attackers. This method is frequently observed in malvertising campaigns and malware distribution where adversaries attempt to maintain long-term access to compromised systems.