wiki created

2025-11-06 12:23:49 +01:00
parent 6cd3511962
commit 2fe9fa8254
60 changed files with 5012 additions and 142 deletions
@@ -0,0 +1,54 @@
+# kill - Terminate Process
+
+Terminate a process by its Process ID (PID).
+
+## Description
+
+The `kill` command terminates a process by its Process ID (PID). The process is immediately terminated using TerminateProcess API. WARNING: Critical system processes (PID 0, 4, 8) are blocked from termination.
+
+## Syntax
+
+```
+kill <pid>
+```
+
+## Parameters
+
+- `pid` (required): Process ID of the process to terminate.
+
+## Examples
+
+```
+kill 1234
+kill 5678
+```
+
+## Features
+
+- The process is immediately terminated using TerminateProcess API
+- Compatible with Mythic Process Browser for interactive process termination
+- Automatically removes the killed process from the Process Browser view
+- WARNING: Critical system processes (PID 0, 4, 8) are blocked from termination to prevent system instability
+- Creates a 'Process Termination' artifact for tracking
+
+## Output
+
+```
+[kill] Process terminated: explorer.exe (PID: 1234)
+```
+
+## OPSEC Considerations
+
+- Process termination is logged by EDR/XDR solutions
+- Terminating critical processes may trigger alerts
+- Process termination artifacts are automatically tracked
+
+## Related
+
+[Process Browser Integration](../../../features.md#process-browser-integration), [Artifacts Support](../../../features.md#artifacts-support)
+
+---
+
+**Command Category:** Process Management  
+**Requires Admin:** No  
+**MITRE ATT&CK:** [T1489 - Service Stop](https://attack.mitre.org/techniques/T1489/)