Taskkill Symantec Endpoint Protection Process

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects the use of the 'taskkill' command to terminate the 'ccSvcHst.exe' process, which is associated with Symantec Endpoint Protection. This action can disable the antivirus software due to an incorrect implementation of the protected service mechanism, allowing a SYSTEM user to kill the process and shut down the service.