DragonForce Ransomware Pre-Encryption Process Kill: MsMpEng/SQL/Oracle
Detects when a single process terminates two or more critical security, database, or backup related processes within a short window. This behavior is often associated with adversary attempts to disable security controls or disrupt database operations, commonly observed during the impact phase of an attack or preparatory to data destruction/encryption.
Cortex XDR
