Kimsuky JSE Loader Self-Deletion via FileSystemObject (T1070.004)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects the execution of a JSE file by a script host (wscript.exe or cscript.exe) followed by the immediate deletion of that same file within a 5-minute window. This behavior is indicative of a 'fileless' or 'dropper' style execution pattern where a script is executed to perform malicious activity and then self-deleted to remove artifacts.