Automated response: killing a process – Capsule8

Deprecation warning: for sensor versions prior to 4.3.0, only a single response action can be specified, and this is defined with the use of the responseAction directive. In this case, alerts are automatically created, regardless of the response action. To enable a kill response using this directive, specify responseAction: kill. This directive is deprecated and cannot be used together with the more flexible responseActions directive introduced in sensor version 4.3.0. The remainder of this article applies to the use of responseActions with sensor version 4.3.0 and above.

If you are changing the response action for one of Capsule8's detections, please refer to Adjusting default detections for instructions. If you're editing a custom policy or writing a new one, keep reading below.

A kill response action is performed by sending the SIGKILL signal to a process. This causes the process to exit immediately. It does not wait until the process has exited. This does not kill any other processes the target process may have started.

The following example demonstrates this applied to a program:

Enforced Wget Blocklist:
  policy: program
  responseActions:
  - alert
  - kill
  alertMessage: Unauthorized execution of wget
  comments: This policy detects and kills instances of wget running
  priority: High
  enabled: true
  rules:
  - match programName == "/usr/bin/wget"
  - default ignore

Kill responses can fail. For example, the process in question may no longer be running by the time the signal is sent to it. The following JSON is a truncated example alert for this configuration in a case where the process could not be killed:

"notifications": [
    {
      "timestamp": "2019-04-17T01:58:30.272044949-04:00",
      "name": "Enforced Wget Blocklist",
      "uuid": "25fc84c4-be3f-4159-a55e-1c31f85a29cb",
      "message": "The program \"/usr/bin/wget\" was executed, which violated the \"Enforced Wget Blocklist\" Program Policy.",
      "message_fields": {}
    },
    {
      "timestamp": "2019-04-17T01:58:30.272044949-04:00",
      "name": "Enforced Wget Blocklist",
      "uuid": "25fc84c4-be3f-4159-a55e-1c31f85a29cb",
      "message": "unable to stop process 2745: no such process",
      "message_fields": {
        "action_type": "kill",
        "action_target_type": "process",
        "action_result": "not successful",
        "action_result_details": "no such process"
      }
    }
  ],

Related articles