Process creation via NTFS transaction

Adversaries may inject malicious code into process by abusing NTFS transactions to avoid writing the final executable image to disk. Attackers exploit TxF API and low-level process creation internals to evade traditional file-based detection.

• Platform: Windows
• Severity: High
• MITRE Tactic: Defense Evasion
• MITRE Techniques: T1055, T1055.013

Back to all rules