(YARA) YARA_disable_process

Download Raw

rule UNPROTECT_disable_process {
    meta:
	author = "Thomas Roccia | @fr0gger_"
	description = "Disable blacklisted processes"
    strings:
        $api1 = "CreateToolhelp32Snapshot" nocase
        $api2 = "Process32First" nocase
        $api3 = "Process32Next" nocase
        $api4 = "TerminateProcess" nocase
        $api5 = "NtGetNextProcess" nocase
        $p1 = "taskkill.exe" nocase
        $p2 = "tskill.exe" nocase
    condition:
        uint32(uint32(0x3C)) == 0x4550 and 2 of ($api*) or any of ($p*) 
}

Associated Techniques

Technique Name Technique ID's Snippet(s) OS
Kill Process U0403

Matching Samples 10 most recent

Sample Name Matching Techniques First Seen Last Seen
Клиент.exe 9 2025-07-01 8 hours, 39 minutes ago
libcrypto-1_1.dll 7 2025-07-01 8 hours, 40 minutes ago
test.exe 7 2025-06-20 1 week, 4 days ago
RuntimeBroker.exe 11 2025-06-05 3 weeks, 5 days ago
tel.exe 13 2025-06-01 1 month ago
5.exe 9 2025-05-30 1 month ago
q.apk.exe 8 2025-05-30 1 month ago
cobalt_sample.exe 13 2025-05-25 1 month, 1 week ago
familyhook hackvshack.net.dll 5 2025-05-15 1 month, 2 weeks ago
Grimace.dll 6 2025-05-11 1 month, 2 weeks ago
View All

Created

June 20, 2022

Last Revised

June 20, 2022