Suspicious Command Line Activity: Echoing and Deleting Batch File in TEMP

nomit vyas@xoxo

•updated Jun 22, 2026•0•0•6

This rule detects suspicious command-line activity involving 'cmd.exe' that echoes content into a batch file within the 'C:\Windows\TEMP\' directory and subsequently deletes it. This pattern can be indicative of various malicious activities, including temporary file creation for execution, evasion, or cleanup after execution.