Windows Process Creation: Raccine Removal via taskkill, registry and scheduled task deletion

Detects command-line activity that stops and removes Raccine components through process killing, registry deletion, and scheduled task removal.

FreeUnreviewedSigmahighv1

windows-process-creation-raccine-removal-via-taskkill-registry-and-scheduled-tas-a31eeaed

title: "Windows Process Creation: Raccine Removal via taskkill, registry and scheduled task deletion"
id: 83a23996-cb8a-4795-96de-bb81588a43ec
status: test
description: This rule flags Windows command lines consistent with removing Raccine components by stopping processes, deleting registry entries, and removing scheduled tasks. Attackers may impair or disable defensive tools to reduce incident detection or persistence of security controls. It relies on process creation telemetry and matches specific command-line substrings for taskkill, reg delete of the "Raccine Tray" key, and schtasks /DELETE for Raccine Updater.
references:
  - https://github.com/Neo23x0/Raccine
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_disable_raccine.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-01-21
modified: 2022-10-09
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    CommandLine|contains|all:
      - "taskkill "
      - RaccineSettings.exe
  selection2:
    CommandLine|contains|all:
      - reg.exe
      - delete
      - Raccine Tray
  selection3:
    CommandLine|contains|all:
      - schtasks
      - /DELETE
      - Raccine Rules Updater
  condition: 1 of selection*
falsepositives:
  - Legitimate deinstallation by administrative staff
level: high
license: DRL-1.1
related:
  - id: a31eeaed-3fd5-478e-a8ba-e62c6b3f9ecc
    type: derived

What it detects

This rule flags Windows command lines consistent with removing Raccine components by stopping processes, deleting registry entries, and removing scheduled tasks. Attackers may impair or disable defensive tools to reduce incident detection or persistence of security controls. It relies on process creation telemetry and matches specific command-line substrings for taskkill, reg delete of the "Raccine Tray" key, and schtasks /DELETE for Raccine Updater.

Known false positives

Legitimate deinstallation by administrative staff

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.