Cavern Manticore working-directory wipe after module execution
Detects the mass deletion of files within the directory 'C:\ProgramData\WinDir\'. This behavior is consistent with anti-forensic cleanup activities often performed by the Cavern Manticore malware framework to remove traces of its operational files and working directories after execution.
Microsoft Sentinel (KQL)
