Windows User Profile Binary Terminating Process Via Taskkill

The following analytic detects taskkill.exe being launched with a process ID (/pid) argument by an executable that resides directly within a user profile folder, such as the Downloads or Desktop folder. Filtering for parent processes located two to three directory levels deep under root folder. This activity is significant because browser hijackers and adware droppers executed from the Downloads folder forcefully terminate the running browser by PID so that they can modify its profile and relaunch it with their own settings. If confirmed malicious, this could allow an attacker to tamper with browser preference files, side-load extensions and redirect the victim's browsing traffic.