CmdID

CmdID / Commands

xkill

Kill a window interactively in a graphical session. tldr-pages

On several platforms 1 Sigma rule name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Several platforms

from tldr-pages, CC BY 4.0

Display a cursor to kill a window when pressing the left mouse button (press any other mouse button to cancel)

Trips 1 Sigma rule: mediumTerminate Linux Process Via Kill by Tuan Le (NCSGroup)

Display a cursor to select a window to kill by pressing any mouse button

xkill -button anyIdentify

Trips 1 Sigma rule: mediumTerminate Linux Process Via Kill by Tuan Le (NCSGroup)

Kill a window with a specific ID (use xwininfo to get info about windows)

xkill -id window_idIdentify

Trips 1 Sigma rule: mediumTerminate Linux Process Via Kill by Tuan Le (NCSGroup)

What detects it

Sigma process creation rules that name xkill
mediumTerminate Linux Process Via KillTuan Le (NCSGroup)