DragonForce kill-list process termination prior to encryption

Arnold Chan@slaz

•updated Sep 9, 2026•0•0•1

This rule detects potentially malicious activity where multiple critical processes (such as database engines or email clients) are terminated in a short time frame, correlated with a high volume of file creation or modification events on the same device. This behavior is indicative of destructive activity, such as ransomware encrypting data stores or disabling defensive software.