Ransomware Series: Nova/Gentlemen RaaS AV-EDR Process Termination via taskkill/W

Ibrahim Saud@tektrix

•updated 11 days ago•2•0•1

Detects attempts to terminate security-related processes (AV/EDR) using common administrative tools including taskkill.exe, wmic.exe, and PowerShell Stop-Process. This behavior is frequently observed during the pre-encryption phase of ransomware attacks, such as Nova and Gentlemen, to evade detection.