Kimsuky JSE Loader Self-Deletion and Staged Artifact Cleanup

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects evidence of file deletion activity associated with the Kimsuky NUKESPED loader chain. The rule monitors for the execution of 'del' commands via cmd.exe initiated by script interpreters (wscript.exe, powershell.exe) to remove malicious artifacts such as .jse, .a9oc files, or specific executable names like zlrenu8.exe from the system, characteristic of post-exploitation cleanup.