Added more extensions that could be suspicious for Startup Folder

[swachchhanda000]

Summary of the Pull Request

According to Microsoft, threat actors used a .url internet shortcut that points to a JavaScript file in the Startup folder. As a result, I added the .url extension. While reviewing the rule, I also realized we could include more suspicious extensions, so I added them as well.

Changelog

update: Suspicious Startup Folder Persistence: add more suspicious extensions

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[Copilot]

Pull Request Overview

Adds additional potentially suspicious file extensions (including .url and various script/module types) to a Windows Startup folder persistence detection rule and expands metadata (description, references, authors, tags).

• Expanded description, references, authors, and ATT&CK tagging.
• Broadened extension list (added .cmd, .js, .jse, .lnk, .psd1, .psm1, .url, .vba, .wsf, etc.).
• Updated modified date and tags.

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}