Command-Line Termination of Discord Before Application Injection
Detects taskkill, PowerShell, Windows Management Instrumentation or command-shell activity that attempts to terminate Discord. This activity is often seen with stealers like VVS Stealer which stops active Discord processes before replacing application support files with injected JavaScript.
Microsoft Sentinel (KQL)
