MarkiRAT taskkill termination of svehost.exe with /t /f
Detects the use of taskkill.exe to forcibly terminate a process named 'svehost.exe'. This is often used by adversaries to terminate a process masquerading as a legitimate system process, or potentially an attempt to terminate an impostor service. Note that 'svehost.exe' is a common typo/masquerade for the legitimate 'svchost.exe'.
Microsoft Sentinel (KQL)
