excessive_usage_of_taskkill.yml

name: Excessive Usage Of Taskkill
id: fe5bca48-accb-11eb-a67c-acde48001122
version: 1
date: '2021-05-04'
author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: This analytic identifies excessive usage of `taskkill.exe` application.
  This application is commonly used by adversaries to evade detections by killing
  security product processes or even other processes to evade detection.
search: '| tstats `security_content_summariesonly` values(Processes.process) as process
  values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "taskkill.exe"  by
  Processes.parent_process_name Processes.process_name Processes.dest Processes.user
  _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `excessive_usage_of_taskkill_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name, parent process, and command-line executions from your
  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
  Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used.
known_false_positives: Unknown. Filter as needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
tags:
  analytic_story:
  - XMRig
  automated_detection_testing: passed
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log
  kill_chain_phases:
  - Exploitation
  mitre_attack_id:
  - T1562.001
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Processes.parent_process_name
  - Processes.process_name
  - Processes.dest
  - Processes.user
  - Processes.process
  - Processes.process_id
  security_domain: endpoint