Update proc_creation_win_taskkill_execution.yml

[MalGamy12]

Summary of the Pull Request

Add command line argument flags used with taskkill by the attacker to terminate a process by its PID

Changelog

update: Process Terminated Via Taskkill - Add /pid flag and windash support

Example Log Event

RuleName: -
UtcTime: 2024-10-02 21:02:05.228
ProcessGuid: {6e6be129-b4cd-66fd-cb01-000000001900}
ProcessId: 4568
Image: C:\Windows\System32\taskkill.exe
FileVersion: 10.0.19041.1 (WinBuild.160101.0800)
Description: Terminates Processes
Product: Microsoft® Windows® Operating System
Company: Microsoft Corporation
OriginalFileName: taskkill.exe
CommandLine: taskkill  /pid 380 /f
CurrentDirectory: C:\Users\MalGamy\
User: DESKTOP-0TOC207\MalGamy
LogonGuid: {6e6be129-ae65-66fd-58dc-0d0000000000}
LogonId: 0xDDC58
TerminalSessionId: 1
IntegrityLevel: Medium
Hashes: SHA256=56F8CC2C1790C389394733B84C3FB55E10977E9F0FE0C08110AC11F0FE47F05E
ParentProcessGuid: {6e6be129-b4b0-66fd-c901-000000001900}
ParentProcessId: 1416
ParentImage: C:\Windows\System32\cmd.exe
ParentCommandLine: "C:\Windows\system32\cmd.exe" 
ParentUser: DESKTOP-0TOC207\MalGamy 

[frack113]

LGTM