Post-execution deletion of dropper/staging artifacts (T1070.001)

Ibrahim Saud@tektrix

•updated Jul 2, 2026•2•0•2

Detects scenarios where an executable (.exe) or installer (.msi) is launched from a staging or temporary directory (e.g., Temp, Downloads) and subsequently deleted within 5 minutes. This behavior is indicative of malware or adversary tools cleaning up their own footprints after execution.