Create file for suspicious process termination

[kevross33]

Hi,

This isn't ready for commiting but I am looking for feedback on it. The idea is to detect the killing of other processes or malware processes in a suspicious manner. So these are:

• Command line termination of a process (which is suspicious)
• Termination of another process; either other spawned processes although perhaps this could be ignored & especially user processes and potentially security software even though most are self defending.

The reason this is not ready is simply because while I have command line termination I have not found one that terminate anything but itself using NtTerminateProcess in some tests. So the questions are:

• if handle != "0x00000000" and handle != "0xffffffff": should basically ignore itself (I saw both handles in process termination calls)
• If I am correct in that self.get_name_from_pid(handle) would lookup the targetted process handle
• Finding samples which do this to test.

I would appreciate any feedback with this. Thanks.