Malware Payload Self-Deletion (JDY Botnet)

Ethan Andrews@eandrews

•updated Jun 10, 2026•3•0•10

Detects instances where an executable is deleted immediately after execution, a common defense evasion technique used by memory-resident malware like the JDY botnet. This rule specifically looks for shell processes executing 'chmod +x' or 'chmod 777' followed by 'rm' commands, often chained with '&&', ';', or '||', indicating immediate self-deletion after execution.