Skip to content
Threat Feed

Tag

Process-Termination

4 briefs RSS
high advisory

Suspicious Process Terminating LSASS Process

Detection of a process attempting to terminate the Lsass.exe process, indicating a potential attempt to perform credential dumping, privilege escalation, or evasion of security policies.

Splunk Enterprise +2 lsass process-termination windows
2r
high advisory

Linux Defense Impairment via Process Termination

Detection of 'pkill' command execution on Linux systems, a technique used by threat actors to disable security defenses or terminate critical processes, potentially leading to data corruption or destruction.

Splunk Enterprise +2 defense-evasion process-termination linux
2r
high advisory

Excessive Taskkill Usage for Defense Evasion

Adversaries use taskkill.exe to disable security tools, and this detection identifies instances where taskkill.exe is executed excessively within a short timeframe, indicative of malicious activity aimed at defense evasion.

Splunk Enterprise +2 defense-evasion process-termination windows
2r 1t
high advisory

Detection of Process Termination via File Path Using WMIC

This analytic detects the use of `wmic.exe` with the `delete` command to terminate a process by specifying its executable path, often used to disable security tools or critical processes during the setup of malicious activities like cryptocurrency mining.

Splunk Enterprise +2 process-termination wmic cryptocurrency-mining endpoint
2r