Windows Shell/Scripting Application File Write to Suspicious Folder — Detection Rule

Detects Windows shells and scripting applications that write files to suspicious folders