This rule detects Windows processes where taskkill.exe is launched to terminate another process using a /pid (or -pid) argument, and where the executable initiating the termination resides directly within a user profile folder (for example, C:\Users\<user>\Downloads or C:\Users\<user>\Desktop). It focuses on parent processes located two to three directory levels deep under the Users root, a pattern commonly seen when binaries from user-writable locations (Downloads/Desktop) act without system privilege. The technique is notable in the context of browser hijackers and adware droppers that terminate an active browser by PID to corrupt profile data (such as browser preferences) and relaunch with their own settings, enabling traffic redirection or extension loading. The detection uses a Splunk search that leverages endpoint process data to identify taskkill.exe invocations with a PID argument and a parent process path anchored in a user-owned directory, and then applies a regex to enforce the two-to-three-level depth within the user profile path ending in an .exe. When a match occurs, the rule generates a finding and associates relevant artifacts (parent process and target process) for investigation. The analytic story emphasizes Living Off The Land techniques and Browser Hijacking as the operational context. Known false positives include legitimate portable apps, installers, or updaters started from Downloads/Desktop that legitimately terminate processes; filtering by the parent process name/path can mitigate noise. References are provided for taskkill usage and browser hijacking behavior, and the rule maps to Endpoint telemetry and Windows as the operating system.