taskkill.exe

File Path: C:\windows\system32\taskkill.exe
Description: Terminates Processes

Hashes

Type	Hash
MD5	`0BDA7EC0A57799EF56854017F57E9F9B`
SHA1	`38B1DF4EF753FF67B2EA5069B1B18841F58AA02F`
SHA256	`864D801AEC0B788EB0880A4DE45B202796273867CF08DAF247B672A25704035B`
SHA384	`62DD9F819DD80EFBF1C78BFB5D7571500B53241666900D6D847F100348EC00EFC0EF84BAAF1571CC0275B092D953F563`
SHA512	`7A7C167C08F5121EC179F06DABCEAF8662F54F858CD369AE1BEDEE76DC55151ED02E666EB3ACDC1CBD29849E9E3A1EA50CE69E2C71CEE8BD7B05C6761365363B`
SSDEEP	`3072:EH3ZD80M/Xp6hy2XCquuYZeH5ToM+J/8tDu2xQ:8I0MB1eHlt0ktDu`

Signature

Status: The file C:\windows\system32\taskkill.exe is not digitally signed. You cannot run this script on the current system. For more information about running scripts and setting execution policy, see about_Execution_Policies at http://go.microsoft.com/fwlink/?LinkID=135170
Serial: ``
Thumbprint: ``
Issuer:
Subject:

File Metadata

Original Filename: taskkill.exe.mui
Product Name: Microsoft Windows Operating System
Company Name: Microsoft Corporation
File Version: 6.3.9600.16384 (winblue_rtm.130821-1623)
Product Version: 6.3.9600.16384
Language: English (United States)
Legal Copyright: Microsoft Corporation. All rights reserved.

Possible Misuse

The following table contains possible examples of taskkill.exe being misused. While taskkill.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source	Source File	Example	License
sigma	proc_creation_win_apt_babyshark.yml	`- cmd.exe /c taskkill /im cmd.exe`	DRL 1.0
sigma	proc_creation_win_multiple_suspicious_cli.yml	`- taskkill.exe`	DRL 1.0
sigma	proc_creation_win_susp_del.yml	`#cmd.exe (PID: 1044 cmdline: 'C:\Windows\System32\cmd.exe' /c taskkill /im A8D4.exe /f & timeout /t 6 & del /f /q 'C:\Users\user~1\AppData\Local\Temp\A8D4.exe' & del C:\ProgramData\*.dll & exit`	DRL 1.0
sigma	proc_creation_win_susp_disable_raccine.yml	`- 'taskkill '`	DRL 1.0
sigma	proc_creation_win_susp_spoolsv_child_processes.yml	`- \taskkill.exe`	DRL 1.0
sigma	proc_creation_win_susp_taskkill.yml	`title: Suspicious Execution of Taskkill`	DRL 1.0
sigma	proc_creation_win_susp_taskkill.yml	`taskkill:`	DRL 1.0
sigma	proc_creation_win_susp_taskkill.yml	`Image\\|endswith: \taskkill.exe`	DRL 1.0
sigma	proc_creation_win_susp_taskkill.yml	`condition: taskkill`	DRL 1.0
LOLBAS	Rundll32.yml	`- Command: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();h=new%20ActiveXObject("WScript.Shell").run("calc.exe",0,true);try{h.Send();b=h.ResponseText;eval(b);}catch(e){new%20ActiveXObject("WScript.Shell").Run("cmd /c taskkill /f /im rundll32.exe",0,true);}`
atomic-red-team	T1027.md	taskkill /f /im calculator.exe >nul 2>nul	MIT License. © 2018 Red Canary
atomic-red-team	T1036.md	taskkill /IM Calculator.exe /f >$null 2>$null	MIT License. © 2018 Red Canary
atomic-red-team	T1047.md	taskkill /f /im calculator.exe	MIT License. © 2018 Red Canary
atomic-red-team	T1489.md	taskkill.exe /f /im #{process_name}	MIT License. © 2018 Red Canary
atomic-red-team	T1574.002.md	taskkill /F /IM #{process_name} >nul 2>&1	MIT License. © 2018 Red Canary
signature-base	apt_golddragon.yar	$s3 = “taskkill /f /im daumcleaner.exe” fullword ascii	CC BY-NC 4.0
signature-base	apt_greenbug.yar	$s4 = “taskkill /im winit.exe /f” fullword ascii	CC BY-NC 4.0
signature-base	apt_irontiger.yar	$s5 = “taskkill /im conime.exe” fullword ascii	CC BY-NC 4.0
signature-base	apt_keyboys.yar	$s1 = “taskkill /f /pid %s” fullword ascii	CC BY-NC 4.0
signature-base	apt_leviathan.yar	$x2 = “.Run "taskkill /im mshta.exe” ascii	CC BY-NC 4.0
signature-base	apt_oilrig.yar	$a1 = “taskkill /F /IM cscript.exe” fullword ascii	CC BY-NC 4.0
signature-base	apt_op_honeybee.yar	$x1 = “cmd /c taskkill /im cliconfg.exe /f /t && del /f /q” fullword ascii	CC BY-NC 4.0
signature-base	apt_winnti_burning_umbrella.yar	$s1 = “Taskkill /IM %s /F & %s” fullword ascii	CC BY-NC 4.0
signature-base	crime_cn_campaign_njrat.yar	$a1 = “taskkill /f /im cmd.exe” fullword ascii	CC BY-NC 4.0
signature-base	crime_cn_campaign_njrat.yar	$a2 = “taskkill /f /im mstsc.exe” fullword ascii	CC BY-NC 4.0
signature-base	crime_cn_campaign_njrat.yar	$a3 = “taskkill /f /im taskmgr.exe” fullword ascii	CC BY-NC 4.0
signature-base	crime_cn_campaign_njrat.yar	$a4 = “taskkill /f /im regedit.exe” fullword ascii	CC BY-NC 4.0
signature-base	crime_cn_campaign_njrat.yar	$a5 = “taskkill /f /im mmc.exe” fullword ascii	CC BY-NC 4.0
signature-base	crime_nansh0u.yar	$s1 = “taskkill /im cmd.exe /f” fullword ascii	CC BY-NC 4.0
stockpile	95727b87-175c-4a69-8c7a-a5d82746a753.yml	`taskkill /s \\#{remote.host.fqdn} /FI "Imagename eq s4ndc4t.exe"`	Apache-2.0
stockpile	ece5dde3-d370-4c20-b213-a1f424aa8d03.yml	`wmic /node:`”#{remote.host.fqdn}`" /user:`”#{domain.user.name}`" /password:`”#{domain.user.password}`" process call create "taskkill /f /im s4ndc4t.exe"`	Apache-2.0

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

taskkill

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

Ends one or more tasks or processes. Processes can be ended by process ID or image name. You can use the tasklist command command to determine the process ID (PID) for the process to be ended.

[!NOTE] This command replaces the kill tool.

Syntax

taskkill [/s <computer> [/u [<domain>\]<username> [/p [<password>]]]] {[/fi <filter>] [...] [/pid <processID> | /im <imagename>]} [/f] [/t]

Parameters

Parameter	Description
/s `<computer>`	Specifies the name or IP address of a remote computer (do not use backslashes). The default is the local computer.
/u `<domain>\<username>`	Runs the command with the account permissions of the user who is specified by `<username>` or by `<domain>\<username>`. The /u parameter can be specified only if /s is also specified. The default is the permissions of the user who is currently logged on to the computer that is issuing the command.
/p `<password>`	Specifies the password of the user account that is specified in the /u parameter.
/fi `<filter>`	Applies a filter to select a set of tasks. You can use more than one filter or use the wildcard character (``) to specify all tasks or image names. The valid filters are listed in the Filter names, operators, and values* section of this article.
/pid `<processID>`	Specifies the process ID of the process to be terminated.
/im `<imagename>`	Specifies the image name of the process to be terminated. Use the wildcard character (`*`) to specify all image names.
/f	Specifies that processes be forcefully ended. This parameter is ignored for remote processes; all remote processes are forcefully ended.
/t	Ends the specified process and any child processes started by it.

Filter names, operators, and values

Filter Name	Valid Operators	Valid Value(s)
STATUS	eq, ne	`RUNNING \| NOT RESPONDING \| UNKNOWN`
IMAGENAME	eq, ne	Image name
PID	eq, ne, gt, lt, ge, le	PID value
SESSION	eq, ne, gt, lt, ge, le	Session number
CPUtime	eq, ne, gt, lt, ge, le	CPU time in the format HH:MM:SS, where MM and SS are between 0 and 59 and HH is any unsigned number
MEMUSAGE	eq, ne, gt, lt, ge, le	Memory usage in KB
USERNAME	eq, ne	Any valid user name (`<user>` or `<domain\user>`)
SERVICES	eq, ne	Service name
WINDOWTITLE	eq, ne	Window title
MODULES	eq, ne	DLL name

Remarks

The WINDOWTITLE and STATUS filters aren’t supported when a remote system is specified.
The wildcard character (*) is accepted for the */im option, only when a filter is applied.
Ending a remote process is always carried out forcefully, regardless whether the /f option is specified.
Providing a computer name to the hostname filter causes a shutdown, stopping all processes.

Examples

To end the processes with process IDs 1230, 1241, and 1253, type:

taskkill /pid 1230 /pid 1241 /pid 1253

To forcefully end the process Notepad.exe if it was started by the system, type:

taskkill /f /fi "USERNAME eq NT AUTHORITY\SYSTEM" /im notepad.exe

To end all processes on the remote computer Srvmain with an image name beginning with note, while using the credentials for the user account Hiropln, type:

taskkill /s srvmain /u maindom\hiropln /p p@ssW23 /fi "IMAGENAME eq note*" /im *

To end the process with the process ID 2134 and any child processes that it started, but only if those processes were started by the Administrator account, type:

taskkill /pid 2134 /t /fi "username eq administrator"

To end all processes that have a process ID greater than or equal to 1000, regardless of their image names, type:

taskkill /f /fi "PID ge 1000" /im *