kqlElastic-2.0from elastic/detection-rules

High Number of Process Terminations

This rule identifies a high number (10) of process terminations via pkill from the same host within a short time period.\n

Quality

FP risk

—

Forks

Views

ATT&CK techniques

T1489 T1562 T1562.001

Rule sourcerules/linux/impact_process_kill_threshold.toml

event.category:process and host.os.type:linux and event.type:start and (
  (process.name:"pkill" and process.args:"-f") or
  (process.name:kill and process.args:"-9") or
  (process.name:killall)
)