Process execution from a self-deleting binary

Identifies the execution of the process from a self-deleting binary. The attackers can abuse undocumented API functions to create a process from a file-backed section. The file is put into a delete-pending state allowing the attacker to bypass kernel callback controls by closing the handle to the file before the main thread is spawned.

• Plataforma: Windows
• Severidad: High
• Táctica MITRE: Evasión de defensas
• Técnicas MITRE: T1055

Volver a todas las reglas