Threat Huntmediumtest

Terminate Linux Process Via Kill

Detects usage of command line tools such as "kill", "pkill" or "killall" to terminate or signal a running process.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Tuan Le (NCSGroup)Created Thu Mar 16Updated Thu Dec 1264c41342-6b27-523b-5d3f-c265f3efcdb3linux

Hunting Hypothesis

Log Source

LinuxProcess Creation

ProductLinux← raw: linux

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        Image|endswith:
            - '/kill'
            - '/killall'
            - '/pkill'
            - '/xkill'
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

TA0005 · Defense Evasion

Techniques

T1562 · Impair Defenses

Other

detection.threat-hunting

Rule Metadata

Rule ID

64c41342-6b27-523b-5d3f-c265f3efcdb3

Status

test

Level

medium

Type

Threat Hunt

Created

Thu Mar 16

Modified

Thu Dec 12

Author

Tuan Le (NCSGroup)

Path

rules-threat-hunting/linux/process_creation/proc_creation_lnx_susp_process_termination_via_kill.yml

Raw Tags

attack.defense-evasionattack.t1562detection.threat-hunting

View on GitHub