Pay2Key Self-Deletion via fsutil setZeroData and cmd.exe ping delay

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•2

Detects the use of the 'fsutil.exe' utility with the 'setZeroData' argument to perform zero-byte file filling, often used to make files unrecoverable. The rule further filters for command lines containing common file deletion commands like 'del' or network connectivity tests like 'ping', indicating possible malicious file removal or destruction activity.