Mustang Panda SHARDLOADER staging artifact deletion via cmd.exe del

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects post-staging cleanup activities consistent with Mustang Panda (TA416) operations. This includes the deletion of staging files using Windows cmd.exe, specific file deletion events within the C:\ProgramData\IDM\logs\ directory, and the use of attrib commands to hide directories associated with known staging locations.