Vidar - Self-Deletion via CMD (T1070.004)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•2

Detects the Vidar cleanup phase where it spawns a ping delay loop followed by self-deletion (del) of the AutoIt executable using cmd.exe.