Windows Process Termination via taskkill.exe Execution
Alerts on taskkill.exe executions that use /f along with /im or /pid to force-terminate targeted processes.
- Product
- windows
- Category
- process_creation
- Author
- frack113, MalGamy (Nextron Systems), Nasreddine Bencherchali (SigmaHQ), DRL 1.1
- Published
- 2021-12-26
- Updated
- 2026-07-31
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation where taskkill.exe is executed, including command lines that force termination (/f) and specify the target by image name (/im) or process ID (/pid). Stopping processes and services can be abused by attackers to disrupt defenses or impact availability and data-reliant services. It relies on process creation telemetry that includes the process image path and the full command line, plus the parent process image for basic suppression of likely installer activity.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1489/T1489.md#atomic-test-3---windows---stop-service-by-killing-process
- unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/snipbot-romcom-malware-variant/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_taskkill_execution.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Process Termination via taskkill.exe Execution
id: cc37396c-f2bc-4310-a9e1-d0b0bf3525bb
status: test
description: This rule flags Windows process creation where taskkill.exe is executed, including command lines that force termination (/f) and specify the target by image name (/im) or process ID (/pid). Stopping processes and services can be abused by attackers to disrupt defenses or impact availability and data-reliant services. It relies on process creation telemetry that includes the process image path and the full command line, plus the parent process image for basic suppression of likely installer activity.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1489/T1489.md#atomic-test-3---windows---stop-service-by-killing-process
- https://unit42.paloaltonetworks.com/snipbot-romcom-malware-variant/
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_taskkill_execution.yml
author: frack113, MalGamy (Nextron Systems), Nasreddine Bencherchali, Huntrule Team
date: 2021-12-26
modified: 2024-10-06
tags:
- attack.impact
- attack.t1489
- detection.threat-hunting
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \taskkill.exe
- OriginalFileName: taskkill.exe
selection_cli_force:
- CommandLine|contains|windash: " /f "
- CommandLine|endswith|windash: " /f"
selection_cli_filter_process:
CommandLine|contains|windash:
- " /im "
- " /pid "
filter_main_installers:
ParentImage|contains:
- \AppData\Local\Temp\
- :\Windows\Temp
ParentImage|endswith: .tmp
condition: all of selection_* and not 1 of filter_main_*
falsepositives:
- Expected FP with some processes using this techniques to terminate one of their processes during installations and updates
level: low
license: DRL-1.1
related:
- id: 86085955-ea48-42a2-9dd3-85d4c36b167d
type: derived