Multiple Process Terminations Detected

Ankit Mehta@Secvyn

•updated Jun 12, 2026•0•0•1

This rule detects when a single computer executes 5 or more process termination commands (taskkill or Stop-Process) within a one-hour window. This behavior can be indicative of an adversary attempting to disrupt system operations or evade defenses by stopping security tools or critical services.