Sunturai
Back to results
MediumSplunk security contentOnur Mustafa Erdogan +1

Windows User Profile Binary Terminating Process Via Taskkill

The following analytic detects taskkill.exe being launched with a process ID (/pid) argument by an executable that resides directly within a user profile folder, such as the Downloads or Desktop folder. Filtering for…

Description

The following analytic detects taskkill.exe being launched with a process ID (/pid) argument by an executable that resides directly within a user profile folder, such as the Downloads or Desktop folder. Filtering for parent processes located two to three directory levels deep under root folder. This activity is significant because browser hijackers and adware droppers executed from the Downloads folder forcefully terminate the running browser by PID so that they can modify its profile and relaunch it with their own settings. If confirmed malicious, this could allow an attacker to tamper with browser preference files, side-load extensions and redirect the victim's browsing traffic.

Detection logic

Detection requirements

Platform
ContainersESXiIaaSLinuxmacOSNetwork DevicesWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
crowdstrike_processrollup2sysmon_eventid_1windows_event_log_security_4688

Known benign triggers

  • Portable applications, installers and updaters executed from a user's Downloads or Desktop folder may legitimately use taskkill.exe to close a running instance of themselves or another application. Filter as needed based on the parent process name or path.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice