(YARA) YARA_disable_process

Download Raw

rule UNPROTECT_disable_process {
    meta:
	author = "Thomas Roccia | @fr0gger_"
	description = "Disable blacklisted processes"
    strings:
        $api1 = "CreateToolhelp32Snapshot" nocase
        $api2 = "Process32First" nocase
        $api3 = "Process32Next" nocase
        $api4 = "TerminateProcess" nocase
        $api5 = "NtGetNextProcess" nocase
        $p1 = "taskkill.exe" nocase
        $p2 = "tskill.exe" nocase
    condition:
        uint32(uint32(0x3C)) == 0x4550 and 2 of ($api*) or any of ($p*) 
}

Associated Techniques

Technique Name Technique ID's Snippet(s) OS
Kill Process U0403

Matching Samples 10 most recent

Sample Name Matching Techniques First Seen Last Seen
5.exe 9 2025-05-30 12 hours, 22 minutes ago
q.apk.exe 8 2025-05-30 12 hours, 23 minutes ago
cobalt_sample.exe 13 2025-05-25 6 days, 4 hours ago
familyhook hackvshack.net.dll 5 2025-05-15 2 weeks, 1 day ago
Grimace.dll 6 2025-05-11 2 weeks, 5 days ago
hmpalert.exe 8 2025-04-20 1 month ago
firefox.exe 3 2025-04-26 1 month ago
DarkComet.exe 8 2025-04-25 1 month ago
NLiveConnectorSetup.exe 4 2025-04-05 1 month, 3 weeks ago
mmmm.exe 7 2025-03-23 2 months, 1 week ago
View All

Created

June 20, 2022

Last Revised

June 20, 2022