Massive processes termination burst

Status: experimental
Severity: high
Time window: 1m
Log source: category process_creation, product windows
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to kill multiples services on a host. Attacker may target services related to databases, security products or backups (Veeam, Symantec, Acronis ...).

Known false positives

Administrator debugging

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1489` Service Stop

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Massive processes termination burst
description: Detects scenarios where an attacker attempts to kill multiples services on a host. Attacker may target services related to databases, security products or backups (Veeam, Symantec, Acronis ...).
references:
- https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/
- https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
- https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
- http://woshub.com/killing-windows-services-that-hang-on-stopping/
- https://fourcore.io/blogs/ryuk-ransomware-simulation-mitre-ttp
- https://www.trendmicro.com/en_us/research/22/e/avoslocker-ransomware-variant-abuses-driver-file-to-disable-anti-Virus-scans-log4shell.html
- https://unit42.paloaltonetworks.com/mallox-ransomware/
tags:
- attack.impact
- attack.t1489 # Service Stop 
- attack.defense_evasion
- attack.1562.001 # Impair Defenses: Disable or Modify Tools 
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection: # "taskkill /f /im sql"  
  selection: 
    NewProcessName|endswith: '\taskkill.exe'
    CommandLine|contains:
      - '/f'
      - '-f'
  condition: selection | count(EventRecordID) by Computer > 2
  timeframe: 1m
falsepositives:
- Administrator debugging
level: high

Stages and Predicates

Stage 0: `condition`

selection | count(EventRecordID) by Computer > 2

Stage 1: `selection`

selection:
  NewProcessName|endswith: '\taskkill.exe'
  CommandLine|contains:
    - '/f'
    - '-f'

Threshold: > 2

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-f` corpus 9 (sigma 7, splunk 2) `/f` corpus 7 (sigma 5, splunk 1, kusto 1)	`field:"CommandLine" kind:match`
`NewProcessName`	ends_with	`\taskkill.exe` corpus 4 (sigma 4)	`field:"Image" kind:ends_with value:"\taskkill.exe"`