Donut is a tool that converts Windows payloads into shellcode that can be loaded in memory. Attackers use it to run .NET assemblies, EXEs, or scripts without writing the original file to disk, so defenders should monitor process injection, memory-only execution, and suspicious parent-child process chains.
How Donut Works as an In-Memory Loader
Donut is designed to turn Windows payloads into shellcode so they can execute in memory rather than as a normal file on disk. That changes the execution path, not the underlying payload, which is why defenders often see it as a loader and evasion mechanism rather than a standalone malware family.
The practical effect is that the original .NET assembly, EXE, or script can be staged in a form that is easier to inject into another process. Because the payload never needs to land as a conventional file, traditional file-based controls may have less visibility into what is running.
Why Attackers Use It
Attackers use in-memory loaders to reduce the evidence left behind on disk, complicate static inspection, and blend execution into a trusted process context. That makes Donut attractive when the goal is to run code quickly, quietly, and with fewer obvious artifacts for defenders to inspect.
The abuse pattern is especially relevant when the payload needs to be launched through process injection or other indirect execution paths. In those cases, the loader helps separate the observable execution flow from the original payload source, which can make attribution and triage harder.
Defensive Visibility and Detection
Detection usually depends on observing the execution chain around the loader, not just the payload itself. Suspicious parent-child process relationships, unusual memory permissions, process injection behavior, and scripting or .NET execution in unexpected places are all important signals.
Defenders should also look for cases where a process creates executable memory, loads managed code atypically, or begins network or discovery activity soon after a suspicious launch. A useful reference point for broader adversary behavior mapping is the MITRE ATT&CK Enterprise Matrix, which helps teams connect observed loader behavior to downstream tactics such as execution, privilege escalation, and persistence.
Remediation and Hardening Priorities
Reducing exposure starts with controlling where code can be introduced, which processes may create executable memory, and which applications are allowed to launch script or .NET content. Hardening the host also matters, because the loader is only one part of a broader attack path that usually depends on weak controls elsewhere.
Security teams should align monitoring and prevention around the controls that limit unauthorized execution and improve auditability. The NIST SP 800-53 Rev 5 Security and Privacy Controls provides a strong control baseline for access control, system integrity, audit logging, and configuration management, while NIST Cybersecurity Framework 2.0 helps organise detection and response around the full lifecycle of the threat. Where teams need a concrete hardening reference, CIS Benchmarks are useful for reducing common host-side misconfigurations that make loader-based execution easier.
Risk and Threat Considerations
Donut increases the risk of fileless or file-light execution because the payload can run from memory, often after being injected into another process. That makes it harder to spot with controls that focus mainly on file creation, hash reputation, or conventional application launch events.
Failure mechanism: The loader shifts execution into memory and may exploit trusted process context, which can bypass or weaken controls that expect malware to arrive as a visible file.
Impact: Compromise can become harder to detect, isolate, and investigate, and any follow-on activity, such as credential theft, lateral movement, or persistence, may start from a process that initially looks legitimate.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1055 — Process Injection | Donut relies on in-memory execution and injection-like behavior |
| Recommendation — Map loader behavior to process injection patterns and hunt for hollowing, injection, and unusual memory execution. | ||
| NIST SP 800-53 Rev 5 | AU-2 — Event Logging | Logging is needed to observe suspicious loader execution and parent-child chains |
| SI-4 — System Monitoring | Monitoring is central to spotting fileless execution and injected code | |
| CM-7 — Least Functionality | Restricting unnecessary execution paths reduces loader abuse opportunities | |
| Recommendation — Enable logging for process creation and memory-relevant events to support detection and investigation. Monitor endpoint behavior for injected code, abnormal memory permissions, and suspicious execution chains. Limit executable paths, scripting abuse, and unnecessary interpreters to reduce attack surface. | ||
| CIS Controls v8 | CIS-10 — Malware Defenses | Loader-based malware requires endpoint defenses that detect and contain malicious execution |
| CIS-8 — Audit Log Management | Audit data is needed to reconstruct suspicious process chains and execution flow | |
| Recommendation — Tune malware defenses to detect suspicious memory-only execution and injection behavior. Collect and retain endpoint and process audit logs needed for loader incident review. | ||