TinyRCT Self-Deletion via cmd.exe choice Delay and Del Command

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•0

This rule detects the use of the Windows command shell (cmd.exe) executing a specific pattern involving the 'choice', '/T', and 'del' commands. This sequence is often used as a technique to delay execution or wait for a process to terminate before deleting it, a common tactic for self-deleting malware, scripts, or malicious tools aiming to evade forensic analysis.