Killing a malicious process stops what it is doing right now, but it does not remove the persistence that started it, the credentials it stole or the other processes it spawned. MITRE D3FEND names this countermeasure Process Termination (D3-PT) and defines it as "Terminating a running application process on a computer system." It sits under the Evict tactic as a child of Process Eviction, alongside Process Suspension, Session Termination and Host Shutdown, and its digital artefact is Process. This card explains how termination works on Windows and Linux, which ATT&CK techniques D3FEND relates it to, how security tools apply it, how to confirm the process is really gone, and when termination is the wrong first move. It is written for incident responders, SOC analysts and endpoint engineers.
Key takeaways
- Termination is containment, not eradication. D3FEND's own considerations say terminating a malicious process is not enough to stop an adversary who already has persistence on the host.
- Use the forced path for hostile processes. A polite request (SIGTERM, ExitProcess) can be trapped by the process; SIGKILL on Linux and TerminateProcess on Windows cannot be handled by the target.
- Kill the family at once. Operating systems do not terminate several processes atomically, so a watchdog process can restart its partner; D3FEND notes session termination or a restart may be needed.
- Preserve evidence first where you can. Process memory, open handles and network connections disappear with the process; decide before the kill whether a memory capture or suspension is needed.
- Prove it is gone. Confirm the exit in process termination events, check for respawn over the following hours and remove the persistence that launched it.
D3-PT at a glance
| Attribute | Value |
|---|---|
| D3FEND ID | D3-PT (d3f:ProcessTermination) |
| Tactic | Evict |
| Parent technique | Process Eviction |
| Siblings | Process Suspension (D3-PS), Session Termination (D3-ST), Host Shutdown (D3-HS) |
| Digital artefact | Process (D3FEND relation: terminates Process) |
| Typical triggers named by D3FEND | Anomalous administrative network activity, a failed stack frame canary check, or system call analysis finding an unauthorised system call |
| D3FEND references | Dell Products patent US20060236108A1 (terminating processes not on an authenticated list), CrowdStrike patent US20190026466A1 (malware detection with local models) |
| Evidence of action | Windows event 4689, Sysmon event 5, Linux audit records, EDR action logs |
How it works
The operating system kernel creates and ends processes, and exposes termination through its API. D3FEND describes two kinds of request.
| Platform | Graceful request | Forced termination | Notes from the documentation |
|---|---|---|---|
| Windows API | ExitProcess (called by the process itself) | TerminateProcess | The handle needs the PROCESS_TERMINATE access right. Microsoft documents that TerminateProcess stops all threads, requests cancellation of pending I/O, is asynchronous, and that the process cannot exit until pending I/O completes or is cancelled. Use WaitForSingleObject on the handle to confirm exit |
| Windows tools | taskkill without /F | taskkill /F, PowerShell Stop-Process | D3FEND notes WSL processes ended with the WSL kill command may leave an entry in the Windows process table |
| Linux and Unix | SIGTERM (default action: terminate, but a handler can be installed) | SIGKILL | The signal(7) manual states SIGKILL and SIGSTOP cannot be caught, blocked or ignored. |
D3FEND's considerations list the cases where a kill does not do what responders expect:
- Permissions: on Unix-like systems only root or the process owner can kill a process; on Windows, D3FEND notes, process permissions are managed separately through process security tokens.
- Uninterruptible sleep: a process blocked in a system call (D state in ps output) holds queued signals, including SIGKILL, until the call returns. D3FEND notes that malicious system call handlers point to a kernel-level rootkit, in which case the host should be rebuilt or restored from a backup known to predate the compromise.
- Kernel threads: the kernel may not allow kernel processes to be terminated.
- Zombies: an ended process can keep a process table entry until its parent reaps it on Linux, or until the last handle closes on Windows.
- Remote hosts: a restart needed to clear a hung process can leave a host reachable only in-band unreachable.
ATT&CK techniques D3FEND relates to D3-PT
Relationship type: inferred only. The rows below come from the D3FEND ontology (version 1.6.0, checked November 2026): D3-PT terminates Process, and these ATT&CK techniques access, produce or create a Process. D3FEND describes such relations as inferred, experimental, and expected to improve. Each ID was checked against ATT&CK v20.
| ATT&CK ID | Technique | Relation to Process | What termination achieves |
|---|---|---|---|
| T1003.001 | LSASS Memory | accesses | Stops a dumping tool mid-read; credentials already taken must still be rotated |
| T1003.002 | Security Account Manager | may access | Stops the extracting process; local account passwords must still be reset |
| T1003.004 | LSA Secrets | may access | Stops extraction; service account secrets must still be rotated |
| T1505.003 | Web Shell | produces | Ends commands spawned by the web shell; the shell file remains until removed |
| T1546.007 | Netsh Helper DLL | produces | Ends the current instance; the helper registration relaunches it |
| T1553.006 | Code Signing Policy Modification | may create | Ends the process; the policy change stays until reverted |
| T1564.011 | Ignore Process Interrupts | creates | Processes started to ignore hangup or interrupt signals still end on SIGKILL or TerminateProcess |
The D3FEND website also lists T1053.005 Scheduled Task and T1505.002 Transport Agent, and an entry for Disable or Modify Tools under an ID that ATT&CK v20 has revoked; its successor is T1685 Disable or Modify Tools. The pattern across every row is the same: termination stops the running instance, and the persistence or stolen material survives. Defensive detail is in T1003 OS Credential Dumping, T1505 Server Software Component Defensive Guide, T1546 Event Triggered Execution Defensive Guide and MITRE ATT&CK T1553 Subvert Trust Controls.
Where it is implemented
| Implementation class | How it terminates | Fits when |
|---|---|---|
| EDR automatic prevention | The agent ends a process on a detection verdict, often combined with quarantining the file | High-confidence detections where speed matters more than evidence |
| EDR analyst response actions | An analyst triggers a stop or kill action from the EDR console, often stopping the file's running processes and quarantining the file in one step. Check your EDR vendor's documentation for per-action device limits and how it handles offline devices | Confirmed incidents across several hosts |
| Native OS tools through remote management | taskkill, Stop-Process, kill run through an approved remote shell or management tool | Hosts without EDR, or when the EDR agent itself is impaired |
| Allow-list based termination | Ends any process not on an authenticated list, the design in D3FEND's Dell reference | Recovery of a heavily infected host so repair tools can run |
| Orchestration (SOAR) playbooks | Calls the EDR or management API as one step of a containment workflow | Repeatable responses with approval gates |
The live sibling pages cover the alternatives: D3-PS Process Suspension freezes a process for evidence capture, D3-ST Session Termination ends the whole user session, and D3-HS Host Shutdown stops everything.
Response procedure
- Decide on evidence. If the process may hold keys, injected code or network state that the investigation needs, suspend it and capture memory first. Record the process ID, parent, command line, image hash, user and open connections.
- Map the family. Identify parent, children and sibling processes from process creation events (Windows 4688 or Sysmon event 1) and the EDR process tree. Note any watchdog that restarts the target.
- Block re-execution. Where possible add a block for the file hash or path before the kill, so a respawn fails.
- Terminate with the forced method. Use SIGKILL or TerminateProcess (taskkill /F, Stop-Process) for every process in the family in quick succession, or end the session if they keep respawning.
- Confirm the exit. Check for Windows event 4689 (requires the Audit Process Termination subcategory) or Sysmon event 5, or the EDR action result, for each process ID.
- Remove the launcher. Remove the service, scheduled task, web shell file, registry entry or helper DLL that started the process. The process termination alone is not eradication.
- Rotate what it touched. If the process accessed LSASS, SAM or LSA Secrets, treat every credential cached on that host as exposed, including service account and machine credentials.
- Watch for return. Monitor the host for the same hash, path or command line for at least several days (an NHI Mgmt Group suggestion, not a standard).
Where identity fits
When a credential dumping process is terminated, the secrets it already read remain valid. On servers those are often service account passwords, LSA-stored secrets and machine account credentials used by automation. Rotation of those non-human credentials belongs in the same ticket as the termination; see D3-CRO Credential Rotation and D3-CCSA Credential Compromise Scope Analysis.
How to verify it works
- Logging check: confirm Audit Process Termination is enabled or Sysmon ProcessTerminate events are collected on a sample of hosts, so every kill leaves a record.
- Response drill: on a test host, run a benign process that ignores SIGTERM or restarts itself through a scheduled task, then apply the procedure. Confirm the forced kill works, the scheduled task is found and the process does not return.
- EDR action audit: review the console action history for failed or pending termination actions; offline hosts may never receive them.
- Tamper test: in an authorised exercise, check whether a protected process or an impaired agent blocks termination, and that the fallback path works. See the EDR Tampering and BYOVD Response Playbook.
| Metric | Example target (NHI Mgmt Group suggestion, not a standard) | Why it matters |
|---|---|---|
| Termination actions with a confirmed exit event | 100% | Proves the action took effect |
| Terminations followed by persistence removal in the same incident | 100% | Termination alone is not eradication |
| Respawns of a terminated process within 7 days | Zero | A respawn means the launcher survived |
| Time from confirmed detection to termination | Tracked per severity | Containment speed |
| Credential dumping incidents with rotation completed | 100% | Closes the access the process already gained |
Common failure patterns
- Kill and close: the alert is closed after the kill, and the scheduled task or service relaunches the payload at the next trigger.
- One process at a time: killing processes one by one lets a watchdog restart each one; end the family together or end the session.
- Graceful signal only: SIGTERM or a non-forced taskkill is handled or ignored by the process.
- Evidence destroyed: an automatic kill removes in-memory implants before anyone captures memory.
- Stolen credentials left valid: the dumping tool is stopped but the hashes and secrets it read are used later from another host.
- Rootkit hosts trusted after the kill: where processes hang in kernel calls or reappear without a visible launcher, D3FEND's advice is to rebuild or restore the host rather than keep killing.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IR-4 Incident Handling | Containment and eradication within the incident handling capability |
| NIST SP 800-53 Rev 5 | SI-3 Malicious Code Protection | Blocking or quarantining malicious code, including ending its execution |
| NIST CSF 2.0 | RS.MI-01 | Incidents are contained |
| MITRE D3FEND | Process Eviction, D3-PT | Parent and technique |
Practitioner checklist
- Enable Audit Process Termination or Sysmon ProcessTerminate on servers and endpoints.
- Decide on memory capture or suspension before terminating where evidence matters.
- Map the full process family and end it together, or end the session.
- Use forced termination: SIGKILL, TerminateProcess, taskkill /F.
- Block the file hash or path so the process cannot simply restart.
- Confirm each exit with an event or EDR action result.
- Remove the persistence that launched the process in the same incident.
- Rotate service account and machine credentials after any credential dumping process.
- Rebuild hosts showing kernel-level signs rather than repeating kills.
Standards and references
- MITRE D3FEND: Process Termination (D3-PT)
- Microsoft Learn: TerminateProcess function
- Linux man-pages: signal(7)
- Microsoft Learn: Event 4689, a process has exited
- Microsoft Learn: Sysmon
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls (IR-4, SI-3)
- Dell Products: Instant process termination tool to recover control of an information handling system (US20060236108A1)
Related NHI Mgmt Group resources: Incident Response Guide · EDR Guide · D3-PS Process Suspension · MITRE D3FEND Guide