APT36 Anti-Forensic Cleanup: Deletion of Prior Tooling & Archive Rename

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•4

This rule detects the execution of cmd.exe or powershell.exe where the command line arguments involve the deletion or renaming of specific file names potentially associated with unauthorized activities or malware components. It looks for common command-line utilities (del, ren) being used by command shells on specific files that may indicate artifact cleanup or staging.