{
  "family": "killall",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nKillAll is a classification for malicious scripts, utilities, or \"HackTools\" specifically designed to aggressively terminate running processes across an operating system. While system administrators use legitimate tools to manage processes, threat actors deploy \"KillAll\" variants defensively to disable endpoint security software (AV/EDR), or offensively as a crude \"wiper\" to induce immediate system instability and denial of service.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nKillAll is not a self-propagating virus. It is a tactical tool deployed *after* an attacker has gained a foothold, typically used immediately prior to launching a primary payload (like ransomware) or during the exfiltration phase to disable monitoring.\n\nIts execution is straightforward but highly disruptive:\n<ul>\n<li><strong>Security Software Neutralization:</strong> The script (often a batch file, PowerShell script, or small compiled executable) iterates through the active process list and aggressively attempts to kill processes associated with known antivirus, EDR, and logging services (e.g., `taskkill /F /IM avp.exe`).</li>\n<li><strong>Database Unlocking (Ransomware Prep):</strong> In ransomware attacks, KillAll tools are used to forcibly terminate database services (SQL Server, Exchange) and enterprise applications. This releases file locks, allowing the ransomware to successfully encrypt the critical database files.</li>\n<li><strong>System Instability:</strong> Extremely aggressive variants may attempt to terminate critical Windows subsystem processes, resulting in an immediate Blue Screen of Death (BSOD) or forced reboot, masking other malicious activities.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe execution of a \"KillAll\" script is a critical, \"break-glass\" security incident. It indicates an active, hands-on-keyboard adversary (or a highly automated ransomware strain) is preparing the environment for a catastrophic attack by systematically blinding the organization's defensive and monitoring capabilities.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Isolation and Triage:</strong> The execution of this tool means perimeter defenses have failed and internal monitoring is compromised. Isolate the affected endpoints immediately. Assume a major payload (like ransomware) is imminent or already deploying.</li>\n<li><strong>Investigate the Source:</strong> Determine how the script was executed (e.g., via a compromised RDP session, a scheduled task, or a web shell). This identifies the attacker's entry point.</li>\n<li><strong>Re-enable Defenses and Re-image:</strong> Endpoints where security tools were successfully neutralized must be considered deeply compromised. A complete bare-metal wipe and re-image from a trusted baseline is required before the machine can be trusted on the network again.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "HackTool.KillAll",
    "Trojan.KillAV",
    "Script.Wiper"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1562.001",
    "T1489"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T07:05:10Z",
  "type": "HackTool / Security Evader",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}