Skip to content

add word boundary to del regex to prevent false positives#1120

Merged
corkamig merged 2 commits into
mandiant:masterfrom
devarjya27:improve-self-deletion-rule
May 22, 2026
Merged

add word boundary to del regex to prevent false positives#1120
corkamig merged 2 commits into
mandiant:masterfrom
devarjya27:improve-self-deletion-rule

Conversation

@devarjya27

@devarjya27 devarjya27 commented Feb 18, 2026

Copy link
Copy Markdown
Contributor

Closes #1089

  • Added a word boundary \b after del to ensure the pattern only matches the del shell command as a standalone token
  • updated rule passes linting.

Comment thread anti-analysis/anti-forensic/self-deletion/self-delete.yml Outdated
@devarjya27 devarjya27 requested a review from mike-hunhoff April 30, 2026 10:45
@corkamig corkamig merged commit acd90af into mandiant:master May 22, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

mimikatz.exe_: self delete

3 participants