Script Interpreter Deleting Initial Script After Persistence

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•2•0•8

Detects a script interpreter deleting a downloaded HTA, JavaScript, PowerShell, or batch file after persistence has been created. This behavior is often associated with malware like InstallFix to remove initial infection artifacts.