Process Termination (61f1d40e-f3d0-4cc6-aa2d-937b6204194f)
The exit or termination of a running process on a system. This can occur due to normal operations, user-initiated commands, or malicious actions such as process termination by malware to disable security controls.
Data Collection Measures:
- Endpoint Detection and Response (EDR) Tools:
- Monitor process termination events.
- Windows Event Logs:
- Event ID 4689 (Process Termination) – Captures when a process exits, including process ID and parent process.
- Event ID 7036 (Service Control Manager) – Monitors system service stops.
- Sysmon (Windows):
- Event ID 5 (Process Termination) – Detects when a process exits, including parent-child relationships.
- Linux/macOS Monitoring:
- AuditD (
execve,exit_group,killsyscalls) – Captures process termination via command-line interactions. - eBPF/XDP: Monitors low-level system calls related to process termination.
- OSQuery: The processes table can be queried for abnormal exits.
- AuditD (