Process-Termination — CraftedSignal Threat Feed

Suspicious Process Terminating LSASS Process

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This analytic detects a suspicious process attempting to terminate the Lsass.exe process. This is based on identifying processes being granted PROCESS_TERMINATE access to Lsass.exe, which is a critical process responsible for enforcing security policies and handling user credentials. Attackers may attempt to terminate the LSASS process to disable security policies or dump credentials. The initial report stems from ESplunk ESCU detections as of 2026-05-05. Successful termination of LSASS can lead to unauthorized access and persistence within the environment.

Attack Chain

An attacker gains initial access to the system, potentially through phishing or exploiting a vulnerability.
The attacker escalates privileges to obtain the necessary permissions to interact with the LSASS process.
The attacker uses a malicious process to request the PROCESS_TERMINATE right on the LSASS process.
Sysmon logs EventCode 10, recording the process requesting PROCESS_TERMINATE access to lsass.exe.
The malicious process successfully terminates the LSASS process.
The operating system may crash or become unstable due to the termination of a critical system process.
The attacker may attempt to dump credentials or perform other malicious activities with the security policies disabled.
The attacker achieves their objective, such as gaining unauthorized access, stealing sensitive data, or establishing persistence.

Impact

Successful termination of the LSASS process can have severe consequences, including system instability, data loss, and unauthorized access to sensitive information. Attackers can leverage this to perform credential dumping, gain elevated privileges, and evade security policies. While the exact number of victims is not specified, the potential impact spans across organizations that rely on Windows-based systems for their operations.

Recommendation

Enable Sysmon EventCode 10 logging to detect processes granted PROCESS_TERMINATE access to lsass.exe.
Deploy the Sigma rule Detect LSASS Process Termination Attempt to your SIEM and tune for your environment.
Investigate any alerts generated by the Sigma rule and determine the root cause of the LSASS process termination.
Review access controls and permissions to limit the ability of unauthorized processes to interact with LSASS.
Monitor systems for unusual process behavior and investigate any suspicious activity promptly.

Linux Defense Impairment via Process Termination

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This threat brief focuses on the malicious use of the pkill command on Linux systems. Threat actors leverage pkill to terminate processes related to security defenses or other critical system functions. The identification of this behavior is crucial for defenders as it signifies an active attempt to impair security controls and evade detection. The observed activity allows further malicious actions and can result in the complete shutdown or disabling of endpoint detection and response agents. This ultimately leads to increased dwell time and potential data exfiltration or destruction. The analytic identifies executions of pkill via command-line arguments and process names.

Attack Chain

An attacker gains initial access to a Linux system (e.g., via compromised credentials or exploiting a vulnerability).
The attacker executes a reconnaissance command, such as ps, to identify running processes, including security tools.
The attacker uses pkill or pgrep to identify specific process IDs of targeted security applications.
The attacker executes pkill to terminate the targeted security processes.
The attacker confirms the successful termination of the security process using ps or similar commands.
With security defenses impaired, the attacker executes malicious code (e.g., malware, scripts) without immediate detection.
The attacker moves laterally within the network to compromise additional systems.
The attacker achieves their objective, which may include data exfiltration, data encryption (ransomware), or system destruction.

Impact

Successful execution of pkill against security applications can severely impair an organization’s ability to detect and respond to threats. This can lead to prolonged dwell time for attackers, enabling them to move laterally within the network, exfiltrate sensitive data, deploy ransomware, or cause irreparable damage to systems. The lack of immediate detection increases the potential for significant financial and reputational damage.

Recommendation

Enable Sysmon for Linux Event ID 1 to capture process creation events, which are essential for detecting pkill executions.
Deploy the provided Sigma rules to your SIEM to detect suspicious pkill command-line executions.
Investigate any alerts generated by these rules to determine the legitimacy of the pkill execution and identify potentially compromised systems.
Tune the Sigma rules in this brief for your environment by filtering out known benign uses of pkill by administrators.

Excessive Taskkill Usage for Defense Evasion

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This brief examines the excessive usage of taskkill.exe, a Windows command-line utility, as an indicator of potential malicious activity. The use of taskkill.exe is a known technique used by attackers to disable security tools or other critical processes to evade detection and maintain persistence on a compromised system. This analytic focuses on detecting instances where taskkill.exe is executed ten or more times within a one-minute span, which is considered an anomalous and suspicious behavior. This detection can identify activity associated with malware families like Azorult, AgentTesla, NjRAT, and XMRig. Successful execution of this technique can allow attackers to bypass security defenses, maintain persistence, and further compromise the system.

Attack Chain

The attacker gains initial access to the system through an exploit or compromised credentials.
The attacker executes a script or program designed to disable security tools.
The script utilizes taskkill.exe to terminate processes associated with antivirus software, endpoint detection and response (EDR) agents, and other security monitoring tools.
taskkill.exe is executed repeatedly within a short timeframe (e.g., 10 or more times in one minute) to ensure the targeted processes are terminated.
With security tools disabled, the attacker can now execute malicious payloads without immediate detection.
The attacker deploys ransomware, steals sensitive data, or establishes a persistent backdoor on the system.
The attacker attempts to move laterally to other systems to expand their control within the network.

Impact

Successful exploitation via excessive taskkill usage can lead to significant disruption, data theft, and financial loss. If attackers successfully disable endpoint protection, they can deploy ransomware, steal sensitive data, or pivot to other systems. This impacts the confidentiality, integrity, and availability of the affected systems and data. Organizations in all sectors are at risk.

Recommendation

Deploy the Sigma rule Excessive Taskkill Usage to your SIEM to detect rapid taskkill executions and tune for your environment.
Enable Sysmon process creation logging (Event ID 1) to provide the necessary data for the Sigma rule.
Ensure that Windows Event Log Security Auditing is enabled (Event ID 4688) to capture process creation events.
Investigate any alerts generated by the Sigma rules, prioritizing those involving privileged accounts or critical systems.

Detection of Process Termination via File Path Using WMIC

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This detection focuses on identifying the use of the Windows Management Instrumentation Command-line (WMIC) utility to terminate processes by referencing their file paths. Specifically, it looks for instances where wmic.exe is used with the delete command targeting an executable path. This technique is often employed by attackers to disable security software, terminate competing processes (such as other miners), or halt critical system services, as seen in cases involving cryptocurrency miners. The activity is often associated with the initial stages of setting up malicious operations on an endpoint, giving defenders an opportunity to disrupt attacks early in the kill chain. The source material was released in 2026, but the underlying technique has been used since at least 2020.

Attack Chain

An attacker gains initial access to the system, often through methods not directly covered by this detection (e.g., exploiting a vulnerability or using compromised credentials).
The attacker executes wmic.exe with specific parameters to target a running process.
The command includes the process argument to specify the process to be targeted, the executablepath argument to identify the process by its file path, and the delete command to terminate the process.
wmic.exe attempts to locate the process based on the provided file path.
If the process is found, wmic.exe sends a termination signal to the process.
The targeted process is terminated.
The attacker repeats this process to disable other security tools or competing processes.
The attacker proceeds with their primary objective, such as deploying and executing a cryptocurrency miner or establishing persistence.

Impact

Successful execution of this technique can lead to the disabling of security software, allowing malware to operate unimpeded. It can also result in the termination of critical system processes, leading to system instability or data loss. Observed cases include the deployment of XMRig cryptocurrency miners following the termination of security tools. If left unchecked, this activity can significantly increase the attacker’s foothold within the compromised environment, facilitating further malicious actions.

Recommendation

Deploy the Sigma rule Detect Process Termination via WMIC File Path to your SIEM and tune it for your environment to identify malicious process termination attempts.
Enable Sysmon process creation logging (Event ID 1) and Windows Event Log Security (4688) to provide the necessary data for the Sigma rules.
Investigate any identified instances of wmic.exe being used with the delete command, especially when targeting executable paths of known security products or critical system processes.
Implement the process_kill_base_on_file_path_filter macro referenced in the search query to reduce noise.