Kazuar Deletes Completed Task and Output Files

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•0•0•3

Detects the Kazuar malware removing job instructions and result files from its working directory after exfiltration or task completion. This rule specifically looks for file deletion events (EventCode 23 or 26 in Sysmon) where the file path matches patterns indicative of task, job, result, output, or stage files with common extensions like json, dat, bin, txt, or zip.