detection.wiki

Detection rules › Sigma

Process Terminated Via Taskkill

Status
test
Severity
low
Log source
product windows, category process_creation
Author
frack113, MalGamy (Nextron Systems), Nasreddine Bencherchali
Source
github.com/SigmaHQ/sigma

Detects execution of "taskkill.exe" in order to stop a service or a process. Look for suspicious parents executing this command in order to hunt for potential malicious activity. Attackers might leverage this in order to conduct data destruction or data encrypted for impact on the data stores of services like Exchange and SQL Server.

MITRE ATT&CK coverage

TacticTechniques
ImpactT1489 Service Stop

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Process Terminated Via Taskkill
id: 86085955-ea48-42a2-9dd3-85d4c36b167d
status: test
description: |
    Detects execution of "taskkill.exe" in order to stop a service or a process. Look for suspicious parents executing this command in order to hunt for potential malicious activity.
    Attackers might leverage this in order to conduct data destruction or data encrypted for impact on the data stores of services like Exchange and SQL Server.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1489/T1489.md#atomic-test-3---windows---stop-service-by-killing-process
    - https://unit42.paloaltonetworks.com/snipbot-romcom-malware-variant/
author: frack113, MalGamy (Nextron Systems), Nasreddine Bencherchali
date: 2021-12-26
modified: 2024-10-06
tags:
    - attack.impact
    - attack.t1489
    - detection.threat-hunting
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\taskkill.exe'
        - OriginalFileName: 'taskkill.exe'
    selection_cli_force:
        - CommandLine|contains|windash: ' /f '
        - CommandLine|endswith|windash: ' /f'
    selection_cli_filter_process:
        CommandLine|contains|windash:
            - ' /im '
            - ' /pid '
    filter_main_installers:
        ParentImage|contains:
            - '\AppData\Local\Temp\'
            - ':\Windows\Temp'
        ParentImage|endswith: '.tmp'
    condition: all of selection_* and not 1 of filter_main_*
falsepositives:
    - Expected FP with some processes using this techniques to terminate one of their processes during installations and updates
level: low

Stages and Predicates

Stage 0: condition

all of selection_* and not 1 of filter_main_*

Stage 1: selection_img

selection_img:
    - Image|endswith: '\taskkill.exe'
    - OriginalFileName: 'taskkill.exe'

Stage 2: selection_cli_force

selection_cli_force:
    - CommandLine|contains|windash: ' /f '
    - CommandLine|endswith|windash: ' /f'

Stage 3: selection_cli_filter_process

selection_cli_filter_process:
    CommandLine|contains|windash:
        - ' /im '
        - ' /pid '

Stage 4: not filter_main_installers

filter_main_installers:
    ParentImage|contains:
        - '\AppData\Local\Temp\'
        - ':\Windows\Temp'
    ParentImage|endswith: '.tmp'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
ParentImagematch:\Windows\Temp
ParentImagematch\AppData\Local\Temp\
ParentImageends_with.tmp

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLineends_with
  • /f transforms: windash
CommandLinematch
  • /f transforms: windash corpus 2 (sigma 2)
  • /im transforms: windash corpus 2 (sigma 2)
  • /pid transforms: windash corpus 2 (sigma 2)
Imageends_with
  • \taskkill.exe corpus 4 (sigma 4)
OriginalFileNameeq
  • taskkill.exe