Self-Deletion of Staging VBScript via Double-Extension Batch Relay (Exact Match)
Detects creation of a file whose name is exactly ~del.vbs.bat, the self-deletion batch script JadeProx uses to remove its staging VBScript a few seconds after execution. Tightened to require an exact filename boundary and creation by wscript.exe or cmd.exe to reduce coincidental matches.
Microsoft Sentinel (KQL)
