CmdID

CmdID / Commands

pkill

Signal process by name. tldr-pages

On Linux 1 Sigma rule name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Linux

from the toybox, 0BSD
pkill [-fnovx] [-SIGNAL|-l SIGNAL] [PATTERN] [-G GID,] [-g PGRP,] [-P PPID,] [-s SID,] [-t TERM,] [-U UID,] [-u EUID,]
Show 14 options
-lSend SIGNAL (default SIGTERM)
-VVerbose
-fCheck full command line for PATTERN
-GMatch real Group ID(s)
-gMatch Process Group(s) (0 is current user)
-nNewest match only
-oOldest match only
-PMatch Parent Process ID(s)
-sMatch Session ID(s) (0 for current)
-tMatch Terminal(s)
-UMatch real User ID(s)
-uMatch effective User ID(s)
-vNegate the match
-xMatch whole command (not substring)

Several platforms

from tldr-pages, CC BY 4.0

Signal process by name. Mostly used for stopping processes.

Kill all processes which match

pkill "process_name"Identify

Trips 1 Sigma rule: mediumTerminate Linux Process Via Kill by Tuan Le (NCSGroup)

Kill all processes which match their full command instead of just the process name

pkill --full "command_name"Identify

Trips 1 Sigma rule: mediumTerminate Linux Process Via Kill by Tuan Le (NCSGroup)

Force kill matching processes (can't be blocked)

pkill -SIGKILL "process_name"Identify
-GMatch real Group ID(s) toybox

Trips 1 Sigma rule: mediumTerminate Linux Process Via Kill by Tuan Le (NCSGroup)

Send SIGUSR1 signal to processes which match

pkill -SIGUSR1 "process_name"Identify
-GMatch real Group ID(s) toybox
-UMatch real User ID(s) toybox

Trips 1 Sigma rule: mediumTerminate Linux Process Via Kill by Tuan Le (NCSGroup)

Kill the main firefox process to close the browser

pkill --oldest "firefox"Identify

Trips 1 Sigma rule: mediumTerminate Linux Process Via Kill by Tuan Le (NCSGroup)

What detects it

Sigma process creation rules that name pkill
mediumTerminate Linux Process Via KillTuan Le (NCSGroup)