High Process Termination Frequency

Description

The following analytic identifies a high frequency of process termination events on a computer within a short period. It leverages Sysmon EventCode 5 logs to detect instances where 15 or more processes are terminated within a 3-second window. This behavior is significant as it is commonly associated with ransomware attempting to avoid exceptions during file encryption. If confirmed malicious, this activity could indicate an active ransomware attack, potentially leading to widespread file encryption and significant data loss.

Query · spl

`sysmon` EventCode=5
  | bin _time span=3s
  | stats values(process) as process values(process_exec) as process_exec values(process_guid) as process_guid values(process_id) as process_id values(process_name) as process_name values(process_path) as process_path values(user_id) as user_id min(_time) as firstTime max(_time) as lastTime count
    BY _time dest EventCode
       ProcessID signature signature_id
       vendor_product
  | where count >= 15
  | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)`
  | `high_process_termination_frequency_filter`

Implementation guide

To successfully implement this search, you need to be ingesting logs with the Image (process full path of terminated process) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.

Known false positives

  • admin or user tool that can terminate multiple process.

Analyst notes

Known false positives: admin or user tool that can terminate multiple process.

Raw source High Process Termination Frequency · SPL
Esc
Published by splunk/security_content ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
name: High Process Termination Frequency
id: 17cd75b2-8666-11eb-9ab4-acde48001122
version: 14
creation_date: '2021-03-19'
modification_date: '2026-05-13'
author: Teoderick Contreras
status: production
type: Anomaly
description: The following analytic identifies a high frequency of process termination events on a computer within a short period. It leverages Sysmon EventCode 5 logs to detect instances where 15 or more processes are terminated within a 3-second window. This behavior is significant as it is commonly associated with ransomware attempting to avoid exceptions during file encryption. If confirmed malicious, this activity could indicate an active ransomware attack, potentially leading to widespread file encryption and significant data loss.
data_source:
    - Sysmon EventID 5
search: |-
    `sysmon` EventCode=5
      | bin _time span=3s
      | stats values(process) as process values(process_exec) as process_exec values(process_guid) as process_guid values(process_id) as process_id values(process_name) as process_name values(process_path) as process_path values(user_id) as user_id min(_time) as firstTime max(_time) as lastTime count
        BY _time dest EventCode
           ProcessID signature signature_id
           vendor_product
      | where count >= 15
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `high_process_termination_frequency_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the Image (process full path of terminated process) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: admin or user tool that can terminate multiple process.
references:
    - https://www.mandiant.com/resources/fin11-email-campaigns-precursor-for-ransomware-data-theft
    - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
drilldown_searches:
    - name: View the detection results for - "$dest$"
      search: '%original_detection_search% | search  dest = "$dest$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$dest$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: 7d
      latest_offset: "0"
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: High frequency process termination (more than 15 processes within 3s) detected on host $dest$
analytic_story:
    - BlackByte Ransomware
    - Rhysida Ransomware
    - LockBit Ransomware
    - Medusa Ransomware
    - Crypto Stealer
    - Snake Keylogger
    - Clop Ransomware
    - Termite Ransomware
    - Interlock Ransomware
    - NailaoLocker Ransomware
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1486
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-sysmon.log
          source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
          sourcetype: XmlWinEventLog
      test_type: unit

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.