Skip to content
Threat Feed
Subscribe
low advisory

Detection of Unauthorized Process Termination in Containers

Adversaries utilize process termination utilities within containers to disrupt security agents, terminate competing processes, or maintain resource dominance.

Triage facts

Revision 1
Applicability
Linux
Evidence
Unknown
Severity
Low
Action
Monitor or close
Sources
2 public sources
Freshness
Revision 1Nov 4, 03:42 UTC
Detection
1 rule
Source quality
A1Likely

This brief details a detection strategy for identifying the unauthorized use of Linux process-termination utilities within containerized environments. Threat actors commonly enumerate processes and employ commands such as kill, pkill, or killall - often invoked via shell or busybox wrappers - to disable security monitoring tools, web servers, or competing unauthorized tasks (e.g., cryptominers). The detection logic focuses on capturing process execution events originating from within containerized workloads.

Impact

Successful process termination can lead to the loss of visibility into container activity, the disabling of security and monitoring agents, service instability, and the disruption of legitimate business applications.

Recommendation

  • Deploy runtime security monitoring for all containerized workloads to capture process-execution telemetry.
  • Implement the provided detection logic to flag execution of kill, pkill, and killall within containers.
  • Enforce least-privilege configurations for containers, specifically by dropping SYS_PTRACE capabilities and enforcing read-only root filesystems where possible.
  • Restrict interactive container access (exec/attach) using RBAC and just-in-time approval workflows to reduce the surface area for manual process manipulation.

Immediate actions

Review existing container process logs for signs of unauthorized kill commands.

SOC 72h

Threat Hunt

Search for non-standard process termination utilities invoked via shell within container execution telemetry.

T1489 medium medium confidence convert to detection

Data: Container process execution events

Mitigations

Enforce read-only root filesystems and remove unnecessary administrative tools from production container images.

medium IT Operations

T1489

Gaps

  • Difficulty distinguishing between legitimate management scripts and malicious activity without behavioral baselining.

Detection coverage 1

Detect Container Process Termination Utilities

low

Detects the execution of process termination utilities (kill, pkill, killall) directly or via shell environments within a container.

sigma tactics: impact techniques: T1489 sources: process_creation, linux

Detection queries are available on the platform. Get full rules →