Suspicious Command Line Activity: Echoing and Deleting Batch File in TEMP

nomit vyas@xoxo

•updated Jun 24, 2026•1•0•4

This rule detects suspicious command-line activity involving 'cmd.exe' that echoes content into a batch file within the 'C:\Windows\TEMP\' directory and subsequently deletes it. This pattern can be indicative of malware staging, temporary file execution, or attempts to clean up forensic evidence.