Windows Process Termination Using taskkill.exe

title: Windows Process Termination Using taskkill.exe
id: cc37396c-f2bc-4310-a9e1-d0b0bf3525bb
status: test
description: This rule flags process creation where taskkill.exe is executed with force termination options (/f) and includes process targeting arguments (/im or /pid). Attackers and administrators may use this to stop competing processes or disrupt service availability, which can support impact-related objectives. The detection relies on Windows process creation telemetry, matching on executable name and specific command-line patterns indicating forceful termination of a targeted process.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1489/T1489.md#atomic-test-3---windows---stop-service-by-killing-process
  - https://unit42.paloaltonetworks.com/snipbot-romcom-malware-variant/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_taskkill_execution.yml
author: frack113, MalGamy (Nextron Systems), Nasreddine Bencherchali, Huntrule Team
date: 2021-12-26
modified: 2024-10-06
tags:
  - attack.impact
  - attack.t1489
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \taskkill.exe
    - OriginalFileName: taskkill.exe
  selection_cli_force:
    - CommandLine|contains|windash: " /f "
    - CommandLine|endswith|windash: " /f"
  selection_cli_filter_process:
    CommandLine|contains|windash:
      - " /im "
      - " /pid "
  filter_main_installers:
    ParentImage|contains:
      - \AppData\Local\Temp\
      - :\Windows\Temp
    ParentImage|endswith: .tmp
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Expected FP with some processes using this techniques to terminate one of their processes during installations and updates
level: low
license: DRL-1.1
related:
  - id: 86085955-ea48-42a2-9dd3-85d4c36b167d
    type: derived