Command Line
taskkill /IM [IMAGENAME] /F
Description
Taskkill is often abused by cyber threats to impair the functionality of various blue-team applications such as AV, EDR, DLP, Monitoring Applications, Backup Utilities, etc.
Risk
High
Risk Reason
Taskkill is commonly used post-exploitation to kill security-application or backup processes, but will occasionally be invoked by IT operators or developers.
Fidelity
High
Fidelity Reason
Taskkill is a relatively uncommon utility depending on the organization, especially for non-IT users.
Operating Systems
Killchain Phases
References
MITRE ATT&CK TECHNIQUES
URL: https://attack.mitre.org/techniques/T1562/001
Description: Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take the many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information.
Adversaries may also tamper with artifacts deployed and utilized by security tools. Security tools may make dynamic changes to system components in order to maintain visibility into specific events. For example, security products may load their own modules and/or modify those loaded by processes to facilitate data collection. Similar to [Indicator Blocking](https://attack.mitre.org/techniques/T1562/006), adversaries may unhook or otherwise modify these features added by tools (especially those that exist in userland or are otherwise potentially accessible to adversaries) to avoid detection.(Citation: OutFlank System Calls)(Citation: MDSec System Calls)
Tactics: