Malichus Staging File Self-Deletion via Script Interpreter

Ankit Mehta@Secvyn

•updated Aug 5, 2026•2•0•4

This rule detects potentially malicious file deletion activity initiated by a Java-based application. It looks for common deletion commands ('del', 'rm', 'Remove-Item', 'unlink') in process command lines originating from 'java.exe' or 'javaw.exe', specifically targeting common staging paths ('Users\Public', 'AppData\Local\Temp') or filenames matching a specific pattern ('cleo.' followed by digits). This pattern is consistent with the behavior of staging and cleaning up artifacts during an intrusion.