{
  "family": "killproc",
  "sample_count": 141,
  "category": "ransomware",
  "description": "Behavior:Win32/KillProc is a generic, heuristic EDR/AV detection for malware that aggressively attempts to terminate specific processes—most commonly, processes associated with Antivirus software, EDR sensors, and Windows administrative tools.<br><br><b>Understanding KillProc</b><br>For the end-user, this behavior might result in a brief error message or the sudden disappearance of the Antivirus icon in the system tray. For an incident responder, a KillProc alert is a 'Defense Impairment' warning. Malware employs this technique immediately upon execution to blind the endpoint before downloading secondary payloads. If the malware successfully terminates the AV service, the subsequent ransomware or banking trojan will execute without any interference.<br><br><b>Execution and Threat Hunting</b><br>Attackers utilize various methods to terminate processes. The simplest is executing command-line utilities like <code>taskkill /F /IM windefend.exe</code> or <code>net stop WinDefend</code>. More advanced malware uses the Windows API (<code>OpenProcess</code> followed by <code>TerminateProcess</code>). To evade EDR detection of these API calls, sophisticated threats may load a signed, vulnerable kernel driver (a 'Bring Your Own Vulnerable Driver' or BYOVD attack) to terminate the AV process directly from Ring 0 (kernel space), bypassing user-mode EDR hooks entirely.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a completely vulnerable endpoint. Threat hunters should investigate EDR alerts for 'Service Termination', 'Suspicious Driver Load', or 'Process Terminated via API'. Incident responders must immediately review command-line logs (Event ID 4688) for instances of <code>taskkill</code> or <code>net stop</code> targeting security products. The presence of unexpectedly dropped <code>.sys</code> files in the Windows directory is a strong indicator of a BYOVD attack.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1068",
    "T1059.003",
    "T1106",
    "T1489",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1489",
      "name": "Service Stop",
      "tactic": "Impact"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1068",
      "name": "Exploitation for Privilege Escalation",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1106",
      "name": "Native API",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint; the successful termination of an AV process is almost always followed by the execution of a highly destructive payload.",
    "Verify the status of the EDR sensor and Windows Defender; utilize a script to forcefully restart the services if they are stopped.",
    "Capture a full memory image to identify the malware responsible for terminating the processes, especially if it utilized a kernel driver.",
    "If a BYOVD attack is suspected, identify the vulnerable driver (e.g., <code>gdrv.sys</code>) and add its hash to the enterprise blocklist."
  ],
  "what_to_avoid": [
    "Do not assume the endpoint is safe simply because you restarted the AV service; the malware likely established persistence and will kill it again.",
    "Avoid ignoring 'Sensor Offline' alerts in the EDR console; they are frequently the first indicator of a KillProc attack."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}