Linux Process Termination via kill/pkill/killall Commands

title: Linux Process Termination via kill/pkill/killall Commands
id: cf28c0b6-5c1d-4a4f-b7ff-e118a4b460d7
status: test
description: This rule identifies process creation events where the executed image path ends with /kill, /pkill, /killall, or /xkill. Terminating or signaling processes can be used for defensive actions but is also a common attacker technique to impair services or disrupt system activity. It relies on Linux process creation telemetry capturing the executable image name or path.
references:
  - https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html
  - https://www.cyberciti.biz/faq/how-force-kill-process-linux/
  - https://www.geeksforgeeks.org/how-to-kill-processes-on-the-linux-desktop-with-xkill/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/linux/process_creation/proc_creation_lnx_susp_process_termination_via_kill.yml
author: Tuan Le (NCSGroup), Huntrule Team
date: 2023-03-16
modified: 2024-12-12
tags:
  - attack.defense-impairment
  - attack.t1685
  - detection.threat-hunting
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith:
      - /kill
      - /killall
      - /pkill
      - /xkill
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 64c41342-6b27-523b-5d3f-c265f3efcdb3
    type: derived