Process self-deletion correlated to matching creation (exe/task/dir cleanup)

Duo Tech@duotech

•updated Aug 6, 2026•5•0•9

Detects process self-deletion (executable, scheduled task, or install directory) correlated within 60 minutes to a matching prior creation event, indicating post-execution cleanup behavior consistent with loader/RAT install-then-delete patterns such as those used by DOUBLECUP-delivered payloads.