BIOC
Low
✕
Process runs from the recycle bin
Process running from the recycle bin.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Evasion
- Status:
- Enabled
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Hide Artifacts: Hidden Files and Directories (T1564.001)
Indicator:
Process action type = execution AND target process path = *:\$recycle.bin\* Process cgo name != ECSSoftwareAutoUpdater.exe AND ECSManager.exe AND Sapstartsrv.exe AND ECSMonitor.exe AND ECSPlayer.exe AND Chrome.exe AND cgo path != *Microsoft VS Code* Host host os = windows
Preventable: yes