RAT self-deletion of own executable shortly after process launch
This rule identifies processes that delete themselves shortly after execution. It joins process creation events with file deletion events on the same device, filtering for cases where the initiating process file name, ID, and hash match the deleted file, and where the deletion occurs within 120 seconds of the process creation. This behavior is commonly associated with malware or adversary tools attempting to remove traces of their activity.
Microsoft Sentinel (KQL)
