Kimsuky/JDY Self-Deletion After Script Execution (T1070.004)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects instances where script interpreters (wscript/cscript on Windows; sh/bash/busybox on Linux) are used to spawn command-line tools (cmd.exe or rm/unlink) to perform file deletion operations. This is a common pattern for attackers to remove evidence, logs, or tools post-execution.