CHOSEN BRICK-staged process executes mass file deletion or system wipe

Ankit Mehta@Secvyn

•updated Sep 22, 2026•1•0•2

Detects execution of mass file-deletion or system wipe commands triggered by processes running from known persistence or staging locations associated with the CHOSEN BRICK campaign. The rule monitors for the combination of suspicious process paths (such as disguised winappx.exe or SysWOW64-lookalike directories) and destructive command-line arguments like 'del', 'cipher', 'format', or 'vssadmin' operations.