Reduce Donut risk by controlling script and binary execution, using application allowlisting, and monitoring for in-memory payload loading. Donut is often used to turn files into shellcode for fileless execution, so watch for suspicious process injection, unusual memory allocations, and child processes spawned from trusted applications. Limit macro, PowerShell, and DLL abuse paths.
How to reduce Donut’s execution paths
The most effective mitigation is to reduce the opportunities Donut relies on to launch code in a trusted context. That means tightening script, macro, PowerShell, and DLL execution paths, then using application allowlisting so only approved binaries and interpreters can run. Because Donut is often used for fileless execution, defenders should treat trusted processes as a high-value launch surface, not as inherently safe.
In practice, the control goal is to stop untrusted content from crossing from document handling or scripting into executable memory. If an attacker cannot easily start or inject into a trusted process, Donut becomes much harder to use as a delivery and execution stage.
What to look for in memory and process telemetry
Donut activity is often visible less in files and more in runtime behaviour. Look for suspicious process injection, unusual memory allocation patterns, and child processes spawned by applications that normally do not launch interpreters or loaders. Correlate those events with macro-enabled documents, PowerShell activity, scripting hosts, and signed or trusted parent processes that suddenly behave like launchers.
Detection works best when endpoint telemetry and process lineage are reviewed together. A single indicator, such as a memory allocation anomaly, is usually less useful than a chain of events showing document open, script launch, injection, and an unexpected child process.
When prevention is not enough
Even with hardening in place, organisations should plan for the case where a payload has already been staged or executed. That means preserving endpoint telemetry, reviewing recent process trees, and checking whether the same trusted application was used to reach other hosts or accounts. If suspicious activity is found, rotate any credentials, tokens, or sessions that may have been exposed through the compromised execution path.
Fileless payloads are designed to avoid relying on a simple on-disk artifact, so response teams need to treat memory, process, and parent-child relationships as primary evidence sources. If those signals are missing, the investigation will often undercount the scope of compromise.
Risk and Threat Considerations
Donut is attractive because it helps move execution into memory and can blend into trusted application activity. That creates risk not just of payload execution, but of control bypass, detection evasion, and downstream abuse of legitimate tools such as scripting engines and document handlers.
Failure mechanism: An attacker uses a trusted process to load shellcode in memory, bypassing file-based controls and making the malicious activity look like normal application behaviour.
Impact: The result can be stealthier execution, faster lateral movement, and delayed detection because the attacker is operating through software that defenders may already trust.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1055 — Process Injection | Donut commonly relies on process injection and in-memory execution. |
| Recommendation — Hunt for process injection and unexpected runtime code loading in endpoint telemetry. | ||
| CIS Controls v8 | CIS-2 — Inventory and Control of Software Assets | Allowlisting and limiting approved execution paths depend on controlling software execution surfaces. |
| CIS-10 — Malware Defenses | The topic is malware execution and detection, including fileless payload loading. | |
| Recommendation — Restrict execution to approved software and block unauthorised interpreters and loaders. Use malware defenses that detect in-memory payload loading and suspicious child processes. | ||
| NIST SP 800-53 Rev 5 | SI-4 — System Monitoring | Detecting Donut-style activity depends on monitoring process, memory and lineage behaviour. |
| SI-3 — Malicious Code Protection | The mitigations focus on blocking malicious code execution paths and limiting abuse of trusted binaries. | |
| Recommendation — Monitor endpoint process and memory activity for anomalous code loading and injection. Deploy malicious code protections that restrict and detect untrusted script and binary execution. | ||
Practitioner Guidance
What to verify: Confirm that application allowlisting covers scripting hosts, macro-capable applications, and other common launch points, not just obvious executables. Also verify that endpoint monitoring captures parent-child process chains and memory allocation telemetry with enough fidelity to investigate fileless activity.
Decision rule: If a trusted application can still start an interpreter, load unmanaged code, or spawn unexpected children, treat that as a priority hardening gap even if no active infection is confirmed.
Practitioner takeaway: The key judgement is to defend the execution boundary, not only the file boundary, because Donut-style tradecraft is built to turn trusted runtime behaviour into the attack path.
Related resources from NHI Mgmt Group
- Guide: Malware Guide
- How should teams reduce the risk of exposed AI credentials being abused?
- How should teams reduce risk from malicious npm package installs?
- When do non-human identities pose the greatest risk to organizations?
- Why do non-human identities create more risk than many human accounts?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org