EKZ Stealer log.txt Creation and Rapid Self-Deletion Cleanup
Detects the post-exploitation behavior associated with EKZ Stealer, specifically the creation of a credential-containing log file in ProgramData, followed by the rapid deletion of the file and the source stealer binary. This behavior is indicative of anti-forensic cleanup steps often used to conceal credential harvesting activities.
Sigma
