Killproc

Overview

Behavior:Win32/KillProc is a generic, heuristic EDR/AV detection for malware that aggressively attempts to terminate specific processes—most commonly, processes associated with Antivirus software, EDR sensors, and Windows administrative tools.

Understanding KillProc
For the end-user, this behavior might result in a brief error message or the sudden disappearance of the Antivirus icon in the system tray. For an incident responder, a KillProc alert is a 'Defense Impairment' warning. Malware employs this technique immediately upon execution to blind the endpoint before downloading secondary payloads. If the malware successfully terminates the AV service, the subsequent ransomware or banking trojan will execute without any interference.

Execution and Threat Hunting
Attackers utilize various methods to terminate processes. The simplest is executing command-line utilities like <code>taskkill /F /IM windefend.exe or net stop WinDefend. More advanced malware uses the Windows API (OpenProcess followed by TerminateProcess). To evade EDR detection of these API calls, sophisticated threats may load a signed, vulnerable kernel driver (a 'Bring Your Own Vulnerable Driver' or BYOVD attack) to terminate the AV process directly from Ring 0 (kernel space), bypassing user-mode EDR hooks entirely.

Indicators of Compromise & Impact
The impact is a completely vulnerable endpoint. Threat hunters should investigate EDR alerts for 'Service Termination', 'Suspicious Driver Load', or 'Process Terminated via API'. Incident responders must immediately review command-line logs (Event ID 4688) for instances of taskkill or net stop targeting security products. The presence of unexpectedly dropped .sys files in the Windows directory is a strong indicator of a BYOVD attack.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1059.003: Restrict execution of Windows Command Shell (cmd.exe) and block unauthorized batch scripts.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_KILLPROC {
    meta:
        description = "Detects Killproc (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "killproc" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Killproc Activity
id: 81e00ef9fed8fdc2164c02f904dd3fd8
status: experimental
description: Detects generic indicators of the killproc malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*killproc*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately isolate the endpoint; the successful termination of an AV process is almost always followed by the execution of a highly destructive payload.
2. Verify the status of the EDR sensor and Windows Defender; utilize a script to forcefully restart the services if they are stopped.
3. Capture a full memory image to identify the malware responsible for terminating the processes, especially if it utilized a kernel driver.
4. If a BYOVD attack is suspected, identify the vulnerable driver (e.g., <code>gdrv.sys</code>) and add its hash to the enterprise blocklist.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the endpoint is safe simply because you restarted the AV service; the malware likely established persistence and will kill it again.
2. Avoid ignoring 'Sensor Offline' alerts in the EDR console; they are frequently the first indicator of a KillProc attack.

References & External Analysis

• Search "killproc" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Atom
• Alot
• Kirts
• Opesup
• Scarab

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/killproc.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.