Linux process termination via kill, pkill, killall, or xkill command execution
Flags Linux process executions of kill/pkill/killall/xkill by matching executable image path suffixes.
FreeReviewedSigma · Medium · v5
- Product
- linux
- Category
- process_creation
- Author
- Tuan Le (NCSGroup) (SigmaHQ), DRL 1.1
- Published
- 2023-03-16
- Updated
- 2026-07-31
What it detects
Identifies Linux command executions where the invoked image path ends with kill, pkill, killall, or xkill, indicating an attempt to terminate or signal a running process. Attackers may use these utilities to disrupt services, impair availability, or force-stop processes during an operation. The rule relies on process creation telemetry that includes the executing image or command path.
Reporting behind it
- trendmicro.comhttps://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html
- cyberciti.bizhttps://www.cyberciti.biz/faq/how-force-kill-process-linux/
- geeksforgeeks.orghttps://www.geeksforgeeks.org/how-to-kill-processes-on-the-linux-desktop-with-xkill/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/linux/process_creation/proc_creation_lnx_susp_process_termination_via_kill.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
linux-process-termination-via-kill-pkill-killall-commands-64c41342
title: Linux process termination via kill, pkill, killall, or xkill command execution
id: cf28c0b6-5c1d-4a4f-b7ff-e118a4b460d7
status: test
description: Identifies Linux command executions where the invoked image path ends with kill, pkill, killall, or xkill, indicating an attempt to terminate or signal a running process. Attackers may use these utilities to disrupt services, impair availability, or force-stop processes during an operation. The rule relies on process creation telemetry that includes the executing image or command path.
references:
- https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html
- https://www.cyberciti.biz/faq/how-force-kill-process-linux/
- https://www.geeksforgeeks.org/how-to-kill-processes-on-the-linux-desktop-with-xkill/
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/linux/process_creation/proc_creation_lnx_susp_process_termination_via_kill.yml
author: Tuan Le (NCSGroup), Huntrule Team
date: 2023-03-16
modified: 2024-12-12
tags:
- attack.defense-impairment
- attack.t1685
- detection.threat-hunting
logsource:
product: linux
category: process_creation
detection:
selection:
Image|endswith:
- /kill
- /killall
- /pkill
- /xkill
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 64c41342-6b27-523b-5d3f-c265f3efcdb3
type: derived