Process execution from a self-deleting binary

Identifies the execution of the process from a self-deleting binary. The attackers can abuse undocumented API functions to create a process from a file-backed section. The file is put into a delete-pending state allowing the attacker to bypass kernel callback controls by closing the handle to the file before the main thread is spawned.

• Platform: Windows
• Severity: High
• MITRE Tactic: Defense Evasion
• MITRE Techniques: T1055

Back to all rules