Execution Of Non-Existing File

Title: Execution Of Non-Existing File
Status: test
Description:Detects process creation events where the Image field lacks an absolute path, which occurs when the backing file no longer exists on disk at the time of logging - commonly caused by Process Ghosting or other unorthodox process creation techniques.
References:
  -https://pentestlaboratories.com/2021/12/08/process-ghosting/
  -https://www.elastic.co/blog/process-ghosting-a-new-executable-image-tampering-attack
Author: Max Altgelt (Nextron Systems)
Date: 2021-12-09
modified:2026-07-05
Tags:

• -'attack.stealth'
• -'attack.privilege-escalation'
• -'attack.t1055'

Logsource:

• category: process_creation
• product: windows

Detection:
  filter_main_image_absolute_path:
    Image|contains: '\'
  filter_optional_null:
    Image: 'None'
  filter_optional_empty:
    Image:
      -'-'
      -''

  filter_optional_4688:
    - Image:
      - 'MemCompression'
      - 'Registry'
      - 'System'
      - 'vmmem'
      - 'vmmemWSL'
    - CommandLine:
      - 'MemCompression'
      - 'Registry'
      - 'vmmem'
      - 'vmmemWSL'
  condition:not 1 of filter_main_* and not 1 of filter_optional_*
Falsepositives:
  -Unknown
Level: high