Anti-forensic cleanup of 8bfa staging archive/bin in Temp
Detects the deletion of specific staging files (8bfa.zip or 8bfa.bin) within the Windows user's local Temp directory, often associated with adversary cleanup activities after staging data or tools.
Sigma
