SparroWocky anti-forensic self-cleanup: persistence removal and self-delete

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•4

Detects evidence of anti-forensic activities associated with the SparroWocky toolset. The rule monitors for the removal of the 'ProcAuditManager' service, deletion of the 'SnapCart' registry key, and the execution of a self-deleting batch script used to remove forensic artifacts.