File Deleted via IOBitUnlocker

Daniel Koifman@Koifsec

•updated Mar 31, 2026•2•0•40

This rule detects the execution of IOBitUnlocker.exe with the '/delete' command-line argument. IOBitUnlocker is a legitimate tool that can be used to unlock and delete files that are otherwise in use or locked by the operating system. Adversaries may weaponize such legitimate tools to delete files, potentially for data destruction, indicator removal, or to hinder forensic analysis.