Post-C2 Self-Delete or Secondary Payload Execution (Go/Node) by RAT

Ibrahim Saud@tektrix

•updated 12 days ago•1•0•1

Detects suspicious execution patterns characteristic of post-exploitation activity, such as invoking 'go run' or 'node' from non-standard directories like AppData or Temp, as well as the use of command-line routines to delete files after execution (often associated with self-deleting secondary payloads or persistence cleanup).