CmdID

CmdID / Commands

kill

Send signal to process(es). toybox

On Linux 1 Sigma rule name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Linux

from the toybox, 0BSD
kill [-l [SIGNAL] | -s SIGNAL | -SIGNAL] PID...
-lList signal name(s) and number(s)
-sSend SIGNAL (default SIGTERM)

Several platforms

from tldr-pages, CC BY 4.0

Send a signal to a process, usually related to stopping the process. All signals except for SIGKILL and SIGSTOP can be intercepted by the process to perform a clean exit.

Terminate a program using the default SIGTERM (terminate) signal

kill process_idIdentify

Trips 1 Sigma rule: mediumTerminate Linux Process Via Kill by Tuan Le (NCSGroup)

List available signal names (to be used without the SIG prefix)

kill -lIdentify
-lList signal name(s) and number(s) toybox

Trips 1 Sigma rule: mediumTerminate Linux Process Via Kill by Tuan Le (NCSGroup)

Terminate a program using the SIGHUP (hang up) signal. Many daemons will reload instead of terminating

kill -SIGHUP process_idIdentify

Trips 1 Sigma rule: mediumTerminate Linux Process Via Kill by Tuan Le (NCSGroup)

Terminate a program using the SIGINT (interrupt) signal. This is typically initiated by the user pressing <Ctrl c>

kill -SIGINT process_idIdentify

Trips 1 Sigma rule: mediumTerminate Linux Process Via Kill by Tuan Le (NCSGroup)

Signal the operating system to immediately terminate a program (which gets no chance to capture the signal)

kill -SIGKILL process_idIdentify

Trips 1 Sigma rule: mediumTerminate Linux Process Via Kill by Tuan Le (NCSGroup)

Signal the operating system to pause a program until a SIGCONT ("continue") signal is received

kill -SIGSTOP process_idIdentify

Trips 1 Sigma rule: mediumTerminate Linux Process Via Kill by Tuan Le (NCSGroup)

Send a SIGUSR1 signal to all processes with the given GID (group id)

kill -SIGUSR1 -group_idIdentify

Trips 1 Sigma rule: mediumTerminate Linux Process Via Kill by Tuan Le (NCSGroup)

Linux

from tldr-pages, CC BY 4.0

Send a signal to a process, usually related to stopping the process. All signals except for SIGKILL and SIGSTOP can be intercepted by the process to perform a clean exit.

Terminate a program using the default SIGTERM (terminate) signal

kill process_idIdentify

Trips 1 Sigma rule: mediumTerminate Linux Process Via Kill by Tuan Le (NCSGroup)

List signal values and their corresponding names (to be used without the SIG prefix). The available options may depend on the kill implementation

kill -lIdentify
-lList signal name(s) and number(s) toybox

Trips 1 Sigma rule: mediumTerminate Linux Process Via Kill by Tuan Le (NCSGroup)

Terminate a background job

kill %job_idIdentify

Trips 1 Sigma rule: mediumTerminate Linux Process Via Kill by Tuan Le (NCSGroup)

Terminate a program using the SIGHUP (hang up) signal. Many daemons will reload instead of terminating

kill -SIGHUP process_idIdentify

Trips 1 Sigma rule: mediumTerminate Linux Process Via Kill by Tuan Le (NCSGroup)

Terminate a program using the SIGINT (interrupt) signal. This is typically initiated by the user pressing <Ctrl c>

kill -SIGINT process_idIdentify

Trips 1 Sigma rule: mediumTerminate Linux Process Via Kill by Tuan Le (NCSGroup)

Signal the operating system to immediately terminate a program (which gets no chance to capture the signal)

kill -SIGKILL process_idIdentify

Trips 1 Sigma rule: mediumTerminate Linux Process Via Kill by Tuan Le (NCSGroup)

Signal the operating system to pause a program until a SIGCONT ("continue") signal is received

kill -SIGSTOP process_idIdentify

Trips 1 Sigma rule: mediumTerminate Linux Process Via Kill by Tuan Le (NCSGroup)

Send a SIGUSR1 signal to all processes with the given GID (group id)

kill -SIGUSR1 -group_idIdentify

Trips 1 Sigma rule: mediumTerminate Linux Process Via Kill by Tuan Le (NCSGroup)

What detects it

Sigma process creation rules that name kill
mediumTerminate Linux Process Via KillTuan Le (NCSGroup)