cmd.exe Transient Batch File Write-Execute-Delete Evasion

Ethan Andrews@eandrews

•updated Jul 1, 2026•2•0•1

Detects a suspicious command pattern where 'cmd.exe' writes a transient batch file, immediately executes it, and then deletes it. This behavior is a common EDR evasion technique used to execute malicious payloads without leaving persistent traces on the disk.