AV Process Kill Command in C2 Beacon Response

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects HTTP responses from a C2 beacon that contain the keywords "kill" and "process" (case-insensitive) within the URI. This pattern suggests a command being sent from the command and control server to the client to terminate a process, potentially an antivirus process, as part of defense evasion tactics.