Greedy File Deletion Using Del or Erase Command
Detects the execution of the 'del' or 'erase' command-line utilities with wildcard expressions to delete files. This behavior is often observed in malware attempting to remove traces of infection or delete evidence from compromised systems. The rule specifically looks for common executable file extensions like .dll, .exe, .js, and .au3 being targeted by these deletion commands.
Sigma
