SHub Stealer: /tmp/shub_ or out.zip Deleted Post-Exfil in Same Lineage
Detects the deletion of files or archives associated with the SHub Stealer malware (specifically /tmp/shub_ directories or /tmp/out.zip) immediately following staging or exfiltration activity within the same process lineage, which is characteristic of anti-forensic cleanup behaviors.
Cortex XDR
