Kimsuky JSE Loader Self-Deletion of .jse Dropper from Downloads Folder
Detects a suspicious file deletion event where a JSE script is deleted from the Downloads directory by wscript.exe or cscript.exe. This activity is indicative of the Kimsuky threat group's NUKESPED dropper cleaning up its own artifact after execution to avoid forensic detection.
Microsoft Sentinel (KQL)
