rules/windows/process_creation/proc_creation_win_susp_taskkill.yml

title: Suspicious Execution of Taskkill
id: 86085955-ea48-42a2-9dd3-85d4c36b167d
status: experimental
description: Adversaries may stop services or processes in order to conduct Data Destruction or Data Encrypted for Impact on the data stores of services like Exchange and SQL Server.
author: frack113
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1489/T1489.md#atomic-test-3---windows---stop-service-by-killing-process
date: 2021/12/26
logsource:
    category: process_creation
    product: windows
detection:
    taskkill:
        Image|endswith: \taskkill.exe
        CommandLine|contains|all: 
            - /f 
            - /im
    condition: taskkill
falsepositives:
    - Unknown
level: low
tags:
    - attack.impact
    - attack.t1489
$frack113$ Windows Redcannary impact 2021-12-26 12:09:42 +01:00			`title: Suspicious Execution of Taskkill`
			`id: 86085955-ea48-42a2-9dd3-85d4c36b167d`
			`status: experimental`
			`description: Adversaries may stop services or processes in order to conduct Data Destruction or Data Encrypted for Impact on the data stores of services like Exchange and SQL Server.`
			`author: frack113`
			`references:`
			`- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1489/T1489.md#atomic-test-3---windows---stop-service-by-killing-process`
			`date: 2021/12/26`
			`logsource:`
			`category: process_creation`
			`product: windows`
			`detection:`
			`taskkill:`
			`Image\|endswith: \taskkill.exe`
			`CommandLine\|contains\|all:`
			`- /f`
			`- /im`
			`condition: taskkill`
			`falsepositives:`
			`- Unknown`
Update win_pc_susp_taskkill.yml 2021-12-28 12:05:20 +01:00			`level: low`
$frack113$ Windows Redcannary impact 2021-12-26 12:09:42 +01:00			`tags:`
			`- attack.impact`
			`- attack.t1489`