eScan Antivirus Component Deletion with Backup Creation
Detects deletion of eScan antivirus components, including the Remote Support Utility (tvqsapp.exe), preceded or accompanied by creation of ZIP backups in C:\ProgramData\esfsbk. This behavior may indicate malicious tampering or defense evasion associated with eScan supply chain compromise.
Sigma
