host-interaction/process/terminate

terminate process by name in .NET

rule:
  meta:
    name: terminate process by name in .NET
    namespace: host-interaction/process/terminate
    authors:
      - anushka.virgaonkar@mandiant.com
    scopes:
      static: function
      dynamic: span of calls
  features:
    - and:
      - api: System.Diagnostics.Process::GetProcessesByName
      - api: System.Diagnostics.Process::Kill

last edited: 2025-01-29 09:27:13