I have changed this sig name to detect deletion of any executed files from disk which could highlight stealth cleanup. Deleting original EXE is extremely malicious and could be another sig but the sig did not match the original process accurately and in its current form that is being used is not just the original file but any executed file being deleted hence the name change
I have changed this sig name to detect deletion of any executed files from disk which could highlight stealth cleanup. Deleting original EXE is extremely malicious and could be another sig but the sig did not match the original process accurately and in its current form that is being used is not just the original file but any executed file being deleted hence the name change