TinyRCT Self-Deletion via choice.exe Timed Del of PerfWatson2.exe
Detects execution of cmd.exe with specific arguments involving 'choice' and 'PerfWatson2.exe', commonly used for stalling or delaying execution, often as a technique to facilitate anti-analysis or to allow time for subsequent malicious actions during a process lifecycle.
CQL
