ORCHARD · Tool

pkill

5 techniquesmacOSLOOBinsGPL-3.0

Kill security tools

Defense EvasionmacOS

Terminate defensive processes like firewalls, AV, or monitoring tools.

pkill -f "Little Snitch|ESET|osqueryd|Falcon"

Evidence: Upstream reference
Environment: Local host
Compatibility: Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native: Defense Evasion
Detection: Process execution monitoring for pkill: Process execution monitoring for pkill
Endpoint Detection - pkill targeting security tools: Endpoint Detection - pkill targeting security tools
Refs: github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/pkill.yml
www.esentire.com/blog/fake-deepseek-site-infects-mac-users-with-atomic-stealer
ss64.com/mac/pkill.html

Defense EvasionmacOS

Use the -9 signal to forcefully terminate processes that may not respond to normal termination signals. Useful for killing hung security tools.

pkill -9 osqueryd

Evidence: Upstream reference
Environment: Local host
Compatibility: Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native: Defense Evasion
Detection: Process execution monitoring for pkill: Process execution monitoring for pkill
Endpoint Detection - pkill targeting security tools: Endpoint Detection - pkill targeting security tools
Refs: github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/pkill.yml
www.esentire.com/blog/fake-deepseek-site-infects-mac-users-with-atomic-stealer
ss64.com/mac/pkill.html

Defense EvasionmacOS

Terminate all processes belonging to a specific user, potentially ending user sessions or disrupting monitoring.

pkill -u username

Evidence: Upstream reference
Environment: Local host
Compatibility: Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native: Defense Evasion, Impact
Detection: Process execution monitoring for pkill: Process execution monitoring for pkill
Endpoint Detection - pkill targeting security tools: Endpoint Detection - pkill targeting security tools
Refs: github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/pkill.yml
www.esentire.com/blog/fake-deepseek-site-infects-mac-users-with-atomic-stealer
ss64.com/mac/pkill.html

Defense EvasionmacOS

Terminate system logging and monitoring processes to evade detection.

pkill -f "syslog|auditd|osqueryd|esensor|nessusd"

Evidence: Upstream reference
Environment: Local host
Compatibility: Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native: Defense Evasion
Detection: Process execution monitoring for pkill: Process execution monitoring for pkill
Endpoint Detection - pkill targeting security tools: Endpoint Detection - pkill targeting security tools
Refs: github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/pkill.yml
www.esentire.com/blog/fake-deepseek-site-infects-mac-users-with-atomic-stealer
ss64.com/mac/pkill.html

Defense EvasionmacOS

Use exact matching with -x flag to kill specific process by exact name rather than pattern.

pkill -x com.apple.Safari

Evidence: Upstream reference
Environment: Local host
Compatibility: Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native: Defense Evasion, Impact
Detection: Process execution monitoring for pkill: Process execution monitoring for pkill
Endpoint Detection - pkill targeting security tools: Endpoint Detection - pkill targeting security tools
Refs: github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/pkill.yml
www.esentire.com/blog/fake-deepseek-site-infects-mac-users-with-atomic-stealer
ss64.com/mac/pkill.html