TinyRCT Self-Deletion via choice.exe Timed Delay Loop (CL-STA-1062)
Detects the self-deletion mechanism used by the TinyRCT backdoor, which employs a timed delay loop using either 'choice.exe' or 'ping.exe' before executing a file deletion command ('del' or 'erase') to remove its own executable from the system. This behavior is indicative of a malware cleanup routine designed to erase traces of its presence after activity has concluded.
Sigma
