Gentlemen - Process Termination Loop (T1489)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•3

Identifies the ransomware executing taskkill or native APIs to force-quit database and backup processes (SQL, Exchange) to free file locks. This rule specifically looks for 'taskkill.exe' being executed multiple times (more than 3 within a minute) with command-line arguments targeting common database or backup-related process names like 'sql', 'exchange', 'veeam', 'backup', or 'oracle'.