SPECTRALVIPER Anti-Forensics (Self-Deletion)

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•4

Detects self-deletion commands (e.g., rm -f $0) used by Miasma payloads to remove their execution tracks from disk immediately after running. The rule specifically looks for process command lines containing 'rm', '-f', and either '$0' or '%~dp0', which are common patterns for self-deletion in shell scripts.