Process creation via NTFS transaction

Adversaries may inject malicious code into process by abusing NTFS transactions to avoid writing the final executable image to disk. Attackers exploit TxF API and low-level process creation internals to evade traditional file-based detection.

• Plataforma: Windows
• Severidad: High
• Táctica MITRE: Evasión de defensas
• Técnicas MITRE: T1055, T1055.013

Volver a todas las reglas