Stealer/1.0 anti-forensic cleanup via attrib +h or del /f /q

Subhankar H@Andrewsec57

•updated Aug 31, 2026•0•0•4

Detects potential anti-forensic activities performed by malware, specifically the use of 'attrib.exe' to hide files and 'cmd.exe' with 'del /f /q' to forcibly remove dropped payloads. These actions are common indicators of a cleanup phase in a malware lifecycle to hinder analysis.