TencShell - Self-Deletion Execution Phase (T1070.004)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•2

Captures the self-deletion execution phase corresponding to Opcode 0x1B removing the implant from the host disk. This rule specifically looks for 'setup.exe' deleting itself.