GIFTEDCROOK Self-Deletion Command
Detects the deletion of staging artifacts using cmd.exe and the timeout command, a technique used by result.dll (GIFTEDCROOK) for self-deletion after exfiltration. This rule specifically looks for command-line patterns indicative of a delayed file deletion using `timeout /t 5` followed by `& del`.
Microsoft Sentinel (KQL)
