Merge PR #4995 from @secDre4mer - Add `Process Deletion of Its Own Ex…

…ecutable`

new: Process Deletion of Its Own Executable 

---------

Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>

rules/windows/file/file_delete/file_delete_win_delete_own_image.yml

@@ -0,0 +1,21 @@
+title: Process Deletion of Its Own Executable
+id: f01d1f70-cd41-42ec-9c0b-26dd9c22bf29
+status: experimental
+description: |
+    Detects the deletion of a process's executable by itself. This is usually not possible without workarounds and may be used by malware to hide its traces.
+references:
+    - https://github.com/joaoviictorti/RustRedOps/tree/ce04369a246006d399e8c61d9fe0e6b34f988a49/Self_Deletion
+author: Max Altgelt (Nextron Systems)
+date: 2024-09-03
+tags:
+    - attack.defense-evasion
+logsource:
+    product: windows
+    category: file_delete
+detection:
+    selection:
+        TargetFilename|fieldref: Image
+    condition: selection
+falsepositives:
+    - Some false positives are to be expected from uninstallers.
+level: medium