# pkill

> Kill processes by name or pattern.

pkill is a Unix utility available on macOS that sends signals to processes matching a given name or pattern. While intended for legitimate process management, threat actors can abuse pkill to terminate security tools, monitoring daemons, or user applications for defense evasion. It's particularly valuable to attackers as a Living Off the Land technique that avoids bringing custom binaries onto the system.

- Page: https://loobins.io/binaries/pkill/
- Author: Jason Phang Vern - Onn
- Created: 2025-09-08
- Tactics: Defense Evasion, Impact

## Paths

- `/usr/bin/pkill`

## Example Use Cases

### Kill security tools

Terminate defensive processes like firewalls, AV, or monitoring tools.

```bash
pkill -f "Little Snitch|ESET|osqueryd|Falcon"
```

- Tactics: Defense Evasion
- Tags: processes, evasion

### Force kill processes with SIGKILL

Use the -9 signal to forcefully terminate processes that may not respond to normal termination signals. Useful for killing hung security tools.

```bash
pkill -9 osqueryd
```

- Tactics: Defense Evasion
- Tags: processes, sigkill

### Kill all processes for a user

Terminate all processes belonging to a specific user, potentially ending user sessions or disrupting monitoring.

```bash
pkill -u username
```

- Tactics: Defense Evasion, Impact
- Tags: processes, users

### Kill logging and monitoring daemons

Terminate system logging and monitoring processes to evade detection.

```bash
pkill -f "syslog|auditd|osqueryd|esensor|nessusd"
```

- Tactics: Defense Evasion
- Tags: logging, monitoring

### Kill process by exact name match

Use exact matching with -x flag to kill specific process by exact name rather than pattern.

```bash
pkill -x com.apple.Safari
```

- Tactics: Defense Evasion, Impact
- Tags: processes

## Detections

- Process execution monitoring for pkill
- Endpoint Detection - pkill targeting security tools

## Resources

- [Fake DeepSeek Site Infects Mac Users with Atomic (AMOS) Stealer](https://www.esentire.com/blog/fake-deepseek-site-infects-mac-users-with-atomic-stealer)
- [SS64 pkill man page](https://ss64.com/mac/pkill.html)