TinyRCT self-delete via cmd choice /T delay-and-delete targeting PerfWatson2.exe
Detects the execution of a self-deletion routine associated with the TinyRCT backdoor. The rule identifies the use of the Windows 'choice' command to introduce a deliberate delay before deleting the malicious executable 'PerfWatson2.exe' from the AppData Local directory.
YARA-L
