(YARA) YARA_disable_process
rule UNPROTECT_disable_process {
meta:
author = "Thomas Roccia | @fr0gger_"
description = "Disable blacklisted processes"
strings:
$api1 = "CreateToolhelp32Snapshot" nocase
$api2 = "Process32First" nocase
$api3 = "Process32Next" nocase
$api4 = "TerminateProcess" nocase
$api5 = "NtGetNextProcess" nocase
$p1 = "taskkill.exe" nocase
$p2 = "tskill.exe" nocase
condition:
uint32(uint32(0x3C)) == 0x4550 and 2 of ($api*) or any of ($p*)
}
Associated Techniques
Technique Name | Technique ID's | Snippet(s) | OS |
---|---|---|---|
Kill Process | U0403 |
Matching Samples 10 most recent
Sample Name | Matching Techniques | First Seen | Last Seen |
---|---|---|---|
5.exe | 9 | 2025-05-30 | 12 hours, 22 minutes ago |
q.apk.exe | 8 | 2025-05-30 | 12 hours, 23 minutes ago |
cobalt_sample.exe | 13 | 2025-05-25 | 6 days, 4 hours ago |
familyhook hackvshack.net.dll | 5 | 2025-05-15 | 2 weeks, 1 day ago |
Grimace.dll | 6 | 2025-05-11 | 2 weeks, 5 days ago |
hmpalert.exe | 8 | 2025-04-20 | 1 month ago |
firefox.exe | 3 | 2025-04-26 | 1 month ago |
DarkComet.exe | 8 | 2025-04-25 | 1 month ago |
NLiveConnectorSetup.exe | 4 | 2025-04-05 | 1 month, 3 weeks ago |
mmmm.exe | 7 | 2025-03-23 | 2 months, 1 week ago |
Created
June 20, 2022
Last Revised
June 20, 2022