AmnesiaStealer shell history clearing with temp-dir file deletion after unsigned binary execution
Detects shell history clearing (history -c) correlated with deletion of temp-directory files tied to a recently executed unsigned binary, matching AmnesiaStealer's anti-forensic cleanup step.
Microsoft Sentinel (KQL)
