detection.wiki

Detection rules › Sigma

Process Deletion of Its Own Executable

Status
test
Severity
medium
Log source
product windows, category file_delete
Author
Max Altgelt (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects the deletion of a process's executable by itself. This is usually not possible without workarounds and may be used by malware to hide its traces.

MITRE ATT&CK coverage

TacticTechniques
StealthNo specific technique

Event coverage

ProviderEventTitle
SysmonEvent ID 23FileDelete (File Delete archived)
SysmonEvent ID 26FileDeleteDetected (File Delete logged)

Rule body yaml

title: Process Deletion of Its Own Executable
id: f01d1f70-cd41-42ec-9c0b-26dd9c22bf29
status: test
description: |
    Detects the deletion of a process's executable by itself. This is usually not possible without workarounds and may be used by malware to hide its traces.
references:
    - https://github.com/joaoviictorti/RustRedOps/tree/ce04369a246006d399e8c61d9fe0e6b34f988a49/Self_Deletion
author: Max Altgelt (Nextron Systems)
date: 2024-09-03
tags:
    - attack.stealth
logsource:
    product: windows
    category: file_delete
detection:
    selection:
        TargetFilename|fieldref: Image
    condition: selection
falsepositives:
    - Some false positives are to be expected from uninstallers.
level: medium

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    TargetFilename|fieldref: Image

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
TargetFilenamecross_field_compare
  • Image transforms: op:eq