taskkill
Ends one or more tasks or processes. Windows commands reference
On Windows 3 Sigma rules name it File taskkill.exe
Windows
Ends one or more tasks or processes. Processes can be ended by process ID or image name. You can use the tasklist command command to determine the process ID (PID) for the process to be ended. NOTE: This command replaces the kill tool. - The WINDOWTITLE and STATUS filters aren't supported when a remote system is specified. - The wildcard character (*) is accepted for the */im option, only when a filter is applied. - Ending a remote process is always carried out forcefully, regardless whether the /f option is specified. - Providing a computer name to the hostname filter causes a shutdown, stopping all processes.
taskkill [/s <computer> [/u [<domain>\]<username> [/p [<password>]]]] {[/fi <filter>] [...] [/pid <processID> | /im <imagename>]} [/f] [/t]To end the processes with process IDs *1230*, *1241*, and *1253*, type
taskkill /pid 1230 /pid 1241 /pid 1253Identify/pidSpecifies the process ID of the process to be terminated. Windows commands referenceTo forcefully end the process Notepad.exe if it was started by the system, type
taskkill /f /fi "USERNAME eq NT AUTHORITY\SYSTEM" /im notepad.exeIdentify/fSpecifies that processes be forcefully ended. Windows commands reference/fiApplies a filter to select a set of tasks. Windows commands reference/imSpecifies the image name of the process to be terminated. Windows commands referenceTo end all processes on the remote computer Srvmain with an image name beginning with note, while using the credentials for the user account Hiropln, type
taskkill /s srvmain /u maindom\hiropln /p p@ssW23 /fi "IMAGENAME eq note*" /im *Identify/sSpecifies the name or IP address of a remote computer (do not use backslashes). Windows commands reference/uRuns the command with the account permissions of the user who is specified by or by \. Windows commands reference/pSpecifies the password of the user account that is specified in the /u parameter. Windows commands reference/fiApplies a filter to select a set of tasks. Windows commands reference/imSpecifies the image name of the process to be terminated. Windows commands referenceTo end the process with the process ID *2134* and any child processes that it started, but only if those processes were started by the Administrator account, type
taskkill /pid 2134 /t /fi "username eq administrator"Identify/pidSpecifies the process ID of the process to be terminated. Windows commands reference/tEnds the specified process and any child processes started by it. Windows commands reference/fiApplies a filter to select a set of tasks. Windows commands referenceTo end all processes that have a process ID greater than or equal to 1000, regardless of their image names, type
taskkill /f /fi "PID ge 1000" /im *Identify/fSpecifies that processes be forcefully ended. Windows commands reference/fiApplies a filter to select a set of tasks. Windows commands reference/imSpecifies the image name of the process to be terminated. Windows commands referenceShow 18 options
/s <computer>Specifies the name or IP address of a remote computer (do not use backslashes). The default is the local computer./u <domain>\<username>Runs the command with the account permissions of the user who is specified by <username> or by <domain>\<username>. The /u parameter can be specified only if /s is also specified. The default is the permissions of the user who is currently logged on to the computer that is issuing the command./p <password>Specifies the password of the user account that is specified in the /u parameter./fi <filter>Applies a filter to select a set of tasks. You can use more than one filter or use the wildcard character (*) to specify all tasks or image names. The valid filters are listed in the Filter names, operators, and values section of this article./pid <processID>Specifies the process ID of the process to be terminated./im <imagename>Specifies the image name of the process to be terminated. Use the wildcard character (*) to specify all image names./fSpecifies that processes be forcefully ended. This parameter is ignored for remote processes; all remote processes are forcefully ended./tEnds the specified process and any child processes started by it.STATUSeq, ne RUNNING NOT RESPONDING UNKNOWNIMAGENAMEeq, ne Image namePIDeq, ne, gt, lt, ge, le PID valueSESSIONeq, ne, gt, lt, ge, le Session numberCPUtimeeq, ne, gt, lt, ge, le CPU time in the format HH:MM:SS, where MM and SS are between 0 and 59 and HH is any unsigned numberMEMUSAGEeq, ne, gt, lt, ge, le Memory usage in KBUSERNAMEeq, ne Any valid user name (<user> or <domain\user>)SERVICESeq, ne Service nameWINDOWTITLEeq, ne Window titleMODULESeq, ne DLL nameWindows
Terminate a process by its process ID or name.
Terminate a process by its ID
taskkill /pid process_idIdentify/pidSpecifies the process ID of the process to be terminated. Windows commands referenceTerminate a process by its name
taskkill /im process_nameIdentify/imSpecifies the image name of the process to be terminated. Windows commands referenceForcefully terminate a specified process
taskkill /pid process_id /fIdentify/pidSpecifies the process ID of the process to be terminated. Windows commands reference/fSpecifies that processes be forcefully ended. Windows commands referenceTerminate a process and its child processes
taskkill /im process_name /tIdentify/imSpecifies the image name of the process to be terminated. Windows commands reference/tEnds the specified process and any child processes started by it. Windows commands referenceTerminate a process on a remote machine
taskkill /pid process_id /s remote_nameIdentify/pidSpecifies the process ID of the process to be terminated. Windows commands reference/sSpecifies the name or IP address of a remote computer (do not use backslashes). Windows commands referenceDisplay help
taskkill /?Identify