Script Interpreter Deleting Initial Script After Persistence

Ibrahim Saud@tektrix

•updated Jun 22, 2026•1•0•12

Detects a script interpreter deleting a downloaded HTA, JavaScript, PowerShell, or batch file after persistence has been created. This behavior is often associated with malware like InstallFix to remove initial infection artifacts.