Excessive Taskkill Usage for Defense Evasion

This threat brief addresses the excessive use of taskkill.exe, a Windows command-line utility, by various threat actors to terminate processes on compromised systems. The observed behavior involves executing taskkill.exe more than ten times within a one-minute timeframe. This technique is employed to disable security software, terminate monitoring agents, and halt other critical processes that could hinder the attacker's objectives. The DFIR Report has documented similar tactics in SQL Server attacks, while Joe Sandbox analysis reveals the use of taskkill.exe in malicious payloads. Successful execution of this evasion tactic allows attackers to bypass security controls, maintain persistence, and potentially deploy further malicious payloads such as ransomware or data exfiltration tools. This behavior has been associated with multiple malware families including Azorult, AgentTesla, NjRAT, XMRig, Crypto Stealer and BlankGrabber Stealer.

Attack Chain

1. Initial access is achieved through various means, such as exploiting vulnerabilities or social engineering techniques. (TA0001)
2. The attacker gains a foothold on the system and executes malicious code, either directly or through a dropper. (TA0002)
3. The attacker enumerates running processes to identify security tools, monitoring agents, or other critical processes to disable (T1057).
4. The attacker uses taskkill.exe with appropriate arguments to terminate the identified processes. (T1562.001)
5. The attacker repeats the taskkill.exe command multiple times in a short period (more than 10 times within a minute) to ensure the targeted processes are terminated (T1562.001).
6. With security tools disabled, the attacker proceeds to perform malicious activities, such as data exfiltration or lateral movement. (TA0007, TA0008)
7. The attacker may install persistence mechanisms to maintain access to the compromised system, taking advantage of the disabled security controls. (TA0003)
8. The attacker achieves their final objective, such as data theft, ransomware deployment, or disruption of services. (TA0040)

Impact

Successful execution of this attack can lead to significant disruption and damage. Security tools being disabled results in the system becoming vulnerable to further attacks. Data exfiltration can lead to financial loss and reputational damage. Ransomware deployment can encrypt critical data, causing business interruption and financial loss. While exact victim numbers are unavailable, this technique is associated with multiple malware families, indicating widespread potential impact.

Recommendation

• Deploy the provided Sigma rule Excessive Taskkill Execution Count to detect instances where taskkill.exe is executed excessively within a short timeframe.
• Enable process monitoring with command-line logging to capture the execution of taskkill.exe and its arguments, which is required for the Sigma rule to function correctly.
• Investigate any alerts generated by the Sigma rule Excessive Taskkill Execution Count to determine the legitimacy of the taskkill.exe execution and identify potential malicious activity.
• Use the provided Splunk search query to identify instances of excessive taskkill.exe usage in your environment and correlate with other security events to identify potential compromises.
• Implement network segmentation to limit the impact of lateral movement if an attacker successfully disables security tools.
• Review and harden endpoint security configurations to prevent attackers from easily disabling security tools.