StealC Self-Deletion via cmd.exe del After Payload Execution

Duo Tech@duotech

•updated Jun 30, 2026•0•0•1

Detects StealC infostealer post-execution self-deletion. The rule identifies instances where cmd.exe is launched by a non-shell process to forcefully delete an executable file located within TEMP or APPDATA directories, a common TTP used by malware to remove forensic artifacts after data exfiltration.