(YARA) YARA_disable_process
rule UNPROTECT_disable_process {
meta:
author = "Thomas Roccia | @fr0gger_"
description = "Disable blacklisted processes"
strings:
$api1 = "CreateToolhelp32Snapshot" nocase
$api2 = "Process32First" nocase
$api3 = "Process32Next" nocase
$api4 = "TerminateProcess" nocase
$api5 = "NtGetNextProcess" nocase
$p1 = "taskkill.exe" nocase
$p2 = "tskill.exe" nocase
condition:
uint32(uint32(0x3C)) == 0x4550 and 2 of ($api*) or any of ($p*)
}
Associated Techniques
Technique Name | Technique ID's | Snippet(s) | OS |
---|---|---|---|
Kill Process | U0403 |
Matching Samples 10 most recent
Sample Name | Matching Techniques | First Seen | Last Seen |
---|---|---|---|
Клиент.exe | 9 | 2025-07-01 | 8 hours, 39 minutes ago |
libcrypto-1_1.dll | 7 | 2025-07-01 | 8 hours, 40 minutes ago |
test.exe | 7 | 2025-06-20 | 1 week, 4 days ago |
RuntimeBroker.exe | 11 | 2025-06-05 | 3 weeks, 5 days ago |
tel.exe | 13 | 2025-06-01 | 1 month ago |
5.exe | 9 | 2025-05-30 | 1 month ago |
q.apk.exe | 8 | 2025-05-30 | 1 month ago |
cobalt_sample.exe | 13 | 2025-05-25 | 1 month, 1 week ago |
familyhook hackvshack.net.dll | 5 | 2025-05-15 | 1 month, 2 weeks ago |
Grimace.dll | 6 | 2025-05-11 | 1 month, 2 weeks ago |
Created
June 20, 2022
Last Revised
June 20, 2022