Skip to main content

TARGET: Process

info
RequirementsLimitationsConsiderations
Endgame installed on the target hostOnly one host can be targeted at a time
The hostname of the target host
Any one of the following details about the target process: Process Id, Process Name, File Path

TACTIC: Terminate Process​

Responding To An Alert

The procedures for killing a process in response to an Endgame alert is slightly different than targeting a process that is not directly associated with an alert.

  1. From the Endgame web UI, navigate to the Alerts tab on the left-hand pane
  2. Find the alert of interest and click on the respective ALERT TYPE entry to get to the Alert Details page
  3. Click on the suspicious process icon outlined red in the RESOLVER window to open the process details card
  4. Click on Response -> Kill Process
  5. When prompted, confirm the target process details and click Yes to kill the process
  6. Click on Go to Endpoint to go to the Endpoint Details page
  7. Verify that the newest Kill Process response entry under the Activity Timeline says Kill Process (Success)

NOTE: If the entry says Kill Process (Failed), click on the entry to expand the log message to investigate why the response failed

1 - Target the host​

  1. From the Endgame web UI, navigate to the Endpoints tab on the left-hand pane

  2. Find the hostname of interest and click on the respective ENDPOINT NAME to get to the Endpoint Details page

2 - Target and kill the process​

  1. Click on Take Action -> Respond

  2. Click on the Kill Process radio button and fill one the following fields:

    • Process Id (Only kills the specific process with this ID)
    • Process Name (Kills all processes with this name)
    • File Path (Kills all processes running from this executable)

  3. Click on Create Response

  4. Verify that the Responses successfully launched message appears and click Close

3 - Verify the response results​

  1. Wait for the Activity Timeline under the Endpoint Details on the left-hand pane to update with a REFRESH LIST notification

  2. Click on the REFRESH LIST notification

  3. Verify that the newest Kill Process response entry under the Activity Timeline says Kill Process (Success)

NOTE: If the entry says Kill Process (Failed), click on the entry to expand the log message to investigate why the response failed