InvisibleFerret Removes Python Scripts and Archives after Exfiltration

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•3

Detects Python deleting runtime scripts, compiled modules, screenshots, and credential archives from temporary or profile paths. This rule specifically looks for file deletion or creation events where the target file matches common Python script/module extensions (.py, .pyc, .pyd, .so) or archive/image extensions (.zip, .7z, .png, .jpg) within temporary or user profile directories, and the process responsible is identified as Python.