Merge pull request #985 from mandiant/fix/self/delete/fp

mandiant · Jan 29, 2025 · ff76d01 · ff76d01
2 parents c1d2076 + 0e19c20
commit ff76d01
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/anti-analysis/anti-forensic/self-deletion/self-delete.yml b/anti-analysis/anti-forensic/self-deletion/self-delete.yml
@@ -23,8 +23,8 @@ rule:
       - or:
         - string: /\/c\s*del\s*/
           description: "/c del"
-        - string: /del\s*\S/
-          description: "del \"%s\""
+        - string: /(^|[\&;\|]\s*)del(\s.*)?/i
+          description: "echo 1&&del /path/to/file"
       - optional:
         - string: /\s*>\s*nul\s*/i
           description: "> nul"