Process ghosting is a Windows execution trick that starts a process from a file state that is no longer present in the normal way, often by creating a process from a delete-pending or otherwise hidden file mapping. The result can be a running process whose backing file is difficult to inspect, hash, or recover with standard file-based tools.
This matters because many defenses still rely on seeing a file on disk before they can scan it. Attackers use process ghosting to reduce the chance of static analysis, delay sample collection, and make incident response harder. In real intrusions it may appear alongside other evasions such as packing, vulnerable-driver abuse, or unusual parent-child process chains. Defenders should watch for short-lived executables, deleted-on-close artifacts, and process creation events that do not match a normal file lifecycle. Strong EDR telemetry, application control, and file-system monitoring help expose this technique.