JFMBackdoor/Showboat Self-Deletion via cmd.exe del /f from %TEMP%

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects the use of Windows command shell (cmd.exe or powershell.exe) to delete specific files often associated with malicious staging, temporary artifacts, or software components like drivers and configuration files. It specifically flags recursive or forced deletion commands targeting directories such as Temp, ProgramData, or specific filenames commonly used by malware.