marcos.luna
55 lines
1.4 KiB
Markdown
55 lines
1.4 KiB
Markdown
# kill - Terminate Process
|
|
|
|
Terminate a process by its Process ID (PID).
|
|
|
|
## Description
|
|
|
|
The `kill` command terminates a process by its Process ID (PID). The process is immediately terminated using TerminateProcess API. WARNING: Critical system processes (PID 0, 4, 8) are blocked from termination.
|
|
|
|
## Syntax
|
|
|
|
```
|
|
kill <pid>
|
|
```
|
|
|
|
## Parameters
|
|
|
|
- `pid` (required): Process ID of the process to terminate.
|
|
|
|
## Examples
|
|
|
|
```
|
|
kill 1234
|
|
kill 5678
|
|
```
|
|
|
|
## Features
|
|
|
|
- The process is immediately terminated using TerminateProcess API
|
|
- Compatible with Mythic Process Browser for interactive process termination
|
|
- Automatically removes the killed process from the Process Browser view
|
|
- WARNING: Critical system processes (PID 0, 4, 8) are blocked from termination to prevent system instability
|
|
- Creates a 'Process Termination' artifact for tracking
|
|
|
|
## Output
|
|
|
|
```
|
|
[kill] Process terminated: explorer.exe (PID: 1234)
|
|
```
|
|
|
|
## OPSEC Considerations
|
|
|
|
- Process termination is logged by EDR/XDR solutions
|
|
- Terminating critical processes may trigger alerts
|
|
- Process termination artifacts are automatically tracked
|
|
|
|
## Related
|
|
|
|
[Process Browser Integration](../../../features.md#process-browser-integration), [Artifacts Support](../../../features.md#artifacts-support)
|
|
|
|
---
|
|
|
|
**Command Category:** Process Management
|
|
**Requires Admin:** No
|
|
**MITRE ATT&CK:** [T1489 - Service Stop](https://attack.mitre.org/techniques/T1489/)
|