Windows Process Deletes Its Own Executable Image

Flags Windows file deletion events where a process removes its own executable image.

FreeUnreviewedSigmamediumv1

windows-process-deletes-its-own-executable-image-f01d1f70

title: Windows Process Deletes Its Own Executable Image
id: e5cc2eec-e4bd-40ef-9bd9-d054463b03f0
status: test
description: This rule identifies events where a process deletes the same executable that it is currently running (the deleted target matches the process image path). Attackers may use self-deletion to reduce forensic artifacts and hinder analysis, though this can also occur during legitimate uninstall or cleanup workflows. It relies on Windows file deletion telemetry with the deleted target filename matched to the running process Image value.
references:
  - https://github.com/joaoviictorti/RustRedOps/tree/ce04369a246006d399e8c61d9fe0e6b34f988a49/Self_Deletion
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_delete/file_delete_win_delete_own_image.yml
author: Max Altgelt (Nextron Systems), Huntrule Team
date: 2024-09-03
tags:
  - attack.stealth
logsource:
  product: windows
  category: file_delete
detection:
  selection:
    TargetFilename|fieldref: Image
  condition: selection
falsepositives:
  - Some false positives are to be expected from uninstallers.
level: medium
license: DRL-1.1
related:
  - id: f01d1f70-cd41-42ec-9c0b-26dd9c22bf29
    type: derived

What it detects

This rule identifies events where a process deletes the same executable that it is currently running (the deleted target matches the process image path). Attackers may use self-deletion to reduce forensic artifacts and hinder analysis, though this can also occur during legitimate uninstall or cleanup workflows. It relies on Windows file deletion telemetry with the deleted target filename matched to the running process Image value.

Known false positives

Some false positives are to be expected from uninstallers.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.