Angerona/documentation-payload/Cazalla/commands/kill.md

kill - Terminate Process

Terminate a process by its Process ID (PID).

Description

The kill command terminates a process by its Process ID (PID). The process is immediately terminated using TerminateProcess API. WARNING: Critical system processes (PID 0, 4, 8) are blocked from termination.

Syntax

kill <pid>

Parameters

• pid (required): Process ID of the process to terminate.

Examples

kill 1234
kill 5678

Features

• The process is immediately terminated using TerminateProcess API
• Compatible with Mythic Process Browser for interactive process termination
• Automatically removes the killed process from the Process Browser view
• WARNING: Critical system processes (PID 0, 4, 8) are blocked from termination to prevent system instability
• Creates a 'Process Termination' artifact for tracking

Output

[kill] Process terminated: explorer.exe (PID: 1234)

OPSEC Considerations

• Process termination is logged by EDR/XDR solutions
• Terminating critical processes may trigger alerts
• Process termination artifacts are automatically tracked

Related

Process Browser Integration, Artifacts Support

---

Command Category: Process Management
Requires Admin: No
MITRE ATT&CK: T1489 - Service Stop