October 17, 2026
When Your Linux Security Agent Goes Silent, Check for pkill
The alert looked harmless: a Linux server’s endpoint agent had stopped reporting. No patch, no reboot, no network change. 🔍
By Xpert4Cyber
The shell history told the story. One short command, run minutes earlier, had signaled the security agent by name: pkill.
pkill is a built-in tool admins use daily. It is also an easy way for an intruder with a shell to blind defenders, which MITRE ATT&CK tracks as Impair Defenses (T1562.001). 🛡️
The lesson is not to fear the command, but to build habits around it:
⚠️ Preview first: pgrep -a -x firefox shows what a pattern will hit Start with SIGTERM, keep SIGKILL as a last resort Verify afterward Audit kill syscalls with auditd and forward logs off-host
The full guide covers 40 pkill and pgrep examples, the mistakes that cause outages, and detection ideas for telemetry gaps. 📌
Full cheat sheet: https://www.xpert4cyber.com/2026/10/linux-pkill-command-cheat-sheet.html
What is the first thing you check when an agent goes silent? 💬