StealC self-deletion via cmd.exe timeout after credential exfiltration
Detects the execution of 'cmd.exe' with a command line that includes both a 'timeout' command and a 'del /f /q' command. This combination can be indicative of an adversary attempting to delay execution before forcefully deleting files, often seen in destructive malware or during incident response to remove evidence.
Microsoft Sentinel (KQL)
