Self-deleting RAT implant unlinks its own binary at startup
Detects instances where a process deletes its own executable or script file within 15 seconds of being launched. This behavior is often associated with self-modifying implants, transient scripts, or malicious artifacts attempting to minimize their footprint on the host system immediately after execution.
Microsoft Sentinel (KQL)
