Mass termination of productivity, database, backup, and monitoring processes

Subhankar H@Andrewsec57

•updated Jul 8, 2026•0•0•1

Detects the mass termination of processes related to productivity suites (Office, Thunderbird), database management (SQL, Oracle, MySQL, Postgres), system backups (VSS), and security monitoring/analysis tools (Task Manager, Wireshark, Process Explorer/Monitor). This activity is highly suspicious and may indicate an attacker attempting to disrupt services, hinder analysis, or prepare a host for destructive activities like data encryption or deletion.