Skip to content

Latest commit

 

History

History

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
 
 
 
 
 
 

README.md

Process Ghosting

Process Ghosting is a technique that uses a temporary file with pending deletion to create a process from that content.

Usage

To execute the file, pass the EXE file that will be executed:

cargo run --release -- <file.exe>
cargo run --release -- <file.exe> <args>

Real use:

cargo run --release -- mimikatz.exe "coffee localtime"

References