Kill processes by name or pattern.
pkillpkillSandbox: execFile · Timeout: 30s
security.defenseevasion.bypass impact.destruction Kill security tools: Terminate defensive processes like firewalls, AV, or monitoring tools.
pkill -f "Little Snitch|ESET|osqueryd|Falcon"Force kill processes with SIGKILL: Use the -9 signal to forcefully terminate processes that may not respond to normal termination signals. Useful for killing hung security tools.
pkill -9 osquerydKill all processes for a user: Terminate all processes belonging to a specific user, potentially ending user sessions or disrupting monitoring.
pkill -u usernameKill logging and monitoring daemons: Terminate system logging and monitoring processes to evade detection.
pkill -f "syslog|auditd|osqueryd|esensor|nessusd"Kill process by exact name match: Use exact matching with -x flag to kill specific process by exact name rather than pattern.
pkill -x com.apple.Safari| Type | Rule / Indicator |
|---|---|
| other | Process execution monitoring for pkill |
| other | Endpoint Detection - pkill targeting security tools |
pkill is a Unix utility available on macOS that sends signals to processes matching a given name or pattern. While intended for legitimate process management, threat actors can abuse pkill to terminate security tools, monitoring daemons, or user applications for defense evasion. It's particularly valuable to attackers as a Living Off the Land technique that avoids bringing custom binaries onto the system.