Amadey Loader Self-Copy and Relaunch via cmd.exe (taskkill/timeout/del/ren Chain)
Detects a specific command-line pattern used by the Amadey loader to perform self-relocation. The process chain executed via cmd.exe includes 'taskkill', 'timeout', 'del', and 'ren' in a single command line to terminate, delete, rename, and relaunch its executable from a user-writable directory to maintain persistence and evade detection.
Sigma
