Windows Process Deletes Its Own Executable File
Flags Windows file deletion events where a process removes its own executable image.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- file_delete
- Author
- Max Altgelt (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-09-03
- Updated
- 2026-07-31
What it detects
This rule identifies when a process deletes the executable file it is currently running from, by matching the deleted file path to the process image path. Self-deletion is a stealth technique because it can remove on-disk traces and complicate incident investigation. The detection relies on Windows file deletion telemetry and the process image (Image) path included with the event.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-deletes-its-own-executable-image-f01d1f70
title: Windows Process Deletes Its Own Executable File
id: e5cc2eec-e4bd-40ef-9bd9-d054463b03f0
status: test
description: This rule identifies when a process deletes the executable file it is currently running from, by matching the deleted file path to the process image path. Self-deletion is a stealth technique because it can remove on-disk traces and complicate incident investigation. The detection relies on Windows file deletion telemetry and the process image (Image) path included with the event.
references:
- https://github.com/joaoviictorti/RustRedOps/tree/ce04369a246006d399e8c61d9fe0e6b34f988a49/Self_Deletion
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_delete/file_delete_win_delete_own_image.yml
author: Max Altgelt (Nextron Systems), Huntrule Team
date: 2024-09-03
tags:
- attack.stealth
logsource:
product: windows
category: file_delete
detection:
selection:
TargetFilename|fieldref: Image
condition: selection
falsepositives:
- Some false positives are to be expected from uninstallers.
level: medium
license: DRL-1.1
related:
- id: f01d1f70-cd41-42ec-9c0b-26dd9c22bf29
type: derived