Suspicious Command Line Activity: Echoing and Deleting Batch File in TEMP

nomit vyas@xoxo

•updated Jun 24, 2026•1•0•2

This rule detects suspicious command-line activity involving 'cmd.exe' that echoes content into a batch file within the 'C:\Windows\TEMP\' directory and subsequently deletes it. This pattern can be indicative of malware staging or cleanup operations, often used to execute temporary scripts or hide traces of execution.