Linux process termination via kill, pkill, killall, or xkill command execution

title: Linux process termination via kill, pkill, killall, or xkill command execution
id: cf28c0b6-5c1d-4a4f-b7ff-e118a4b460d7
status: test
description: Identifies Linux command executions where the invoked image path ends with kill, pkill, killall, or xkill, indicating an attempt to terminate or signal a running process. Attackers may use these utilities to disrupt services, impair availability, or force-stop processes during an operation. The rule relies on process creation telemetry that includes the executing image or command path.
references:
  - https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html
  - https://www.cyberciti.biz/faq/how-force-kill-process-linux/
  - https://www.geeksforgeeks.org/how-to-kill-processes-on-the-linux-desktop-with-xkill/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/linux/process_creation/proc_creation_lnx_susp_process_termination_via_kill.yml
author: Tuan Le (NCSGroup), Huntrule Team
date: 2023-03-16
modified: 2024-12-12
tags:
  - attack.defense-impairment
  - attack.t1685
  - detection.threat-hunting
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith:
      - /kill
      - /killall
      - /pkill
      - /xkill
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 64c41342-6b27-523b-5d3f-c265f3efcdb3
    type: derived