Hayabusa low test sigma

Process Terminated Via Taskkill

Detects execution of "taskkill.exe" in order to stop a service or a process. Look for suspicious parents executing this command in order to hunt for potential malicious activity. Attackers might leverage this in order to conduct data destruction or data encrypted for impact on the data stores of services like Exchange and SQL Server.

View Source

Detection Logic

{
  "process_creation": {
    "EventID": 4688,
    "Channel": "Security"
  },
  "selection_img": [
    {
      "NewProcessName
| endswith": "\\taskkill.exe"
    },
    {
      "OriginalFileName": "taskkill.exe"
    }
  ],
  "selection_cli_force": [
    {
      "CommandLine
| contains
| windash": " /f "
    },
    {
      "CommandLine
| endswith
| windash": " /f"
    }
  ],
  "selection_cli_filter_process": {
    "CommandLine
| contains
| windash": [
      " /im ",
      " /pid "
    ]
  },
  "filter_main_installers": {
    "ParentProcessName
| contains": [
      "\\AppData\\Local\\Temp\\",
      ":\\Windows\\Temp"
    ],
    "ParentProcessName
| endswith": ".tmp"
  },
  "condition": "process_creation and (all of selection_* and not 1 of filter_main_*)"
}

False Positives

  • ⚠ Expected FP with some processes using this techniques to terminate one of their processes during installations and updates

Field Validations

Loading…

Comments (0)

Loading comments...