Windows Data Destruction Recursive Exec Files Deletion

Yolanda Icepa@yicepa

•updated Jul 3, 2025•3•2•133

Detects a suspicious process recursively deleting or overwriting a high volume of executable files (.exe, .sys, .dll) on a Windows host, leveraging Sysmon Event IDs 23 and 26. This behavior is commonly associated with destructive malware such as CaddyWiper, DoubleZero, and SwiftSlicer.