Process Deletion of Its Own Executable

Status: test
Severity: medium
Log source: category file_delete, product windows
Author: Max Altgelt (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the deletion of a process's executable by itself. This is usually not possible without workarounds and may be used by malware to hide its traces.

Known false positives

Some false positives are to be expected from uninstallers.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	No specific technique

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 23: FileDelete (File Delete archived)
Sysmon	Event ID 26: FileDeleteDetected (File Delete logged)

Rule body

title: Process Deletion of Its Own Executable
id: f01d1f70-cd41-42ec-9c0b-26dd9c22bf29
status: test
description: |
    Detects the deletion of a process's executable by itself. This is usually not possible without workarounds and may be used by malware to hide its traces.
references:
    - https://github.com/joaoviictorti/RustRedOps/tree/ce04369a246006d399e8c61d9fe0e6b34f988a49/Self_Deletion
author: Max Altgelt (Nextron Systems)
date: 2024-09-03
tags:
    - attack.stealth
logsource:
    product: windows
    category: file_delete
detection:
    selection:
        TargetFilename|fieldref: Image
    condition: selection
falsepositives:
    - Some false positives are to be expected from uninstallers.
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    TargetFilename|fieldref: Image

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetFilename`	cross_field_compare	`Image` transforms: `op:eq`	`field:"TargetFilename" kind:cross_field_compare value:"Image"`