Terminate Linux Process Via Kill

A Sigma rule for process creation on Linux, from SigmaHQ’s threat hunting rules, by Tuan Le (NCSGroup).

medium 1 ATT&CK technique 4 programs it names 27 everyday examples trip it

What it looks for

its detection, as SigmaHQ writes it

detection:
  selection:
    Image|endswith:
      - '/kill'
      - '/killall'
      - '/pkill'
      - '/xkill'
  condition: selection

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Tuan Le (NCSGroup), under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

Command lines that trip it

everyday examples from tldr-pages, CC BY 4.0, each read by CmdID

Capture a video from the replay buffer on the page for gpu-screen-recorder

pkill -SIGUSR1 -f gpu-screen-recorderIdentify

Terminate a program using the default SIGTERM (terminate) signal on the page for kill

kill process_idIdentify

List available signal names (to be used without the SIG prefix) on the page for kill

kill -lIdentify

Terminate a program using the SIGHUP (hang up) signal. Many daemons will reload instead of terminating on the page for kill

kill -SIGHUP process_idIdentify

Terminate a program using the SIGINT (interrupt) signal. This is typically initiated by the user pressing <Ctrl c> on the page for kill

kill -SIGINT process_idIdentify

Signal the operating system to immediately terminate a program (which gets no chance to capture the signal) on the page for kill

kill -SIGKILL process_idIdentify

Signal the operating system to pause a program until a SIGCONT ("continue") signal is received on the page for kill

kill -SIGSTOP process_idIdentify

Send a SIGUSR1 signal to all processes with the given GID (group id) on the page for kill

kill -SIGUSR1 -group_idIdentify

Terminate a background job on the page for kill

kill %job_idIdentify

Terminate a process using the default SIGTERM (terminate) signal on the page for killall

killall process_nameIdentify

List available signal names (to be used without the SIG prefix) on the page for killall

killall --listIdentify

Interactively ask for confirmation before termination on the page for killall

killall --interactive process_nameIdentify

And 15 more examples on CmdID’s program pages.

Programs and files it names

their pages here

killkillallpkillxkill

ATT&CK

the techniques it is tagged with

T1685Disable or Modify Tools

Terminate Linux Process Via Kill

What it looks for

Command lines that trip it

Programs and files it names

ATT&CK

Other rules for T1685 Disable or Modify Tools