DragonForce Locker Mass Termination of Security/Backup/DB Processes

Ibrahim Saud@tektrix

•updated 21 days ago•0•0•5

Detects when three or more critical security, database, or service processes are terminated on a Windows host within a short timeframe. This behavior is often indicative of an adversary attempting to disable security monitoring (e.g., Windows Defender/MsMpEng.exe) or perform disruptive activity against critical infrastructure (e.g., SQL Server processes).