(SIGMA) SIGMA_hide_copy_melt
Created the . Updated 2 years, 3 months ago.
title: Hide copy and delete itself
status: experimental
description: Hide copy via attrib.exe and delete itself
author: Joe Security
date: 2019-11-12
id: 200025
threatname:
behaviorgroup: 1
classification: 8
mitreattack:
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine:
- '*attrib +s +h *timeout /t *del /f /q*'
condition: selection
level: critical