Mass File Deletion Consistent with LIUSHEN Secure-Delete Routine

Subhankar H@Andrewsec57

•updated Jul 8, 2026•1•0•1

Detects mass file deletion events within a one-minute window, which may indicate the use of secure deletion tools (such as those observed in LIUSHEN campaigns) or other unauthorized data destruction activities designed to remove forensic artifacts.