Silent Rotor - Parentless Execution Strategy (T1059)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•1

Identifies the usage of CreateProcessA launching a random 6-character executable with a detached or null parent structure, potentially indicative of the Silent Rotor malware's execution strategy. The rule specifically looks for executables with a 6-character alphanumeric filename (e.g., 'abc123.exe') and either no initiating process or an initiating process named 'Подтверждение заказа продукции ЦАИ.exe'.