ongyuann / Process_Ghosting

Process Ghosting is a technique in which a process is created from a delete pending file. This means the created process is not backed by a file. This is an evasion technique.

Process_Ghosting

Process Ghosting is a process injection technique in which an attacker creates a temp file, mark it for deletion (delete-pending state), copies/maps a malware into the memory (image section), close the handle (which deletes it from the disk), then create a process from the now-fileless section.

Usage : "Process Ghosting.exe" <Program to run>