> Source: [sk171910](https://support.checkpoint.com/results/sk/sk171910)

# sk171910 - Terminating/Killing processes using Endpoint's Push Operation

| Property | Value |
|----------|-------|
| Solution ID | sk171910 |
| Date Created | 2021-02-08 |
| Last Modified | 2021-03-15 |
| Technical Level | General |
| Products | Endpoint Security |
| Versions | Cloud, E89.X, E88.X |
| OS | Windows |

## Solution

After identifying a suspicious or malicious process running on an endpoint, you can terminate the process using SmartEndpoint.

Configuration
-------------

Use Custom Push Operation with Type 108  
![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk171910/push_op_type_108202102081209261.png)  

**Operation parameters are specified as `json` string**   

`{`  
` "name":"notepad.exe"`  
`}`  

**Notes:**   

* If only name is set, the operation will try to kill the first process found with a matching name.
* To kill all matching processes, set the `killall` parameter to "true":  

  `{`  
  ` "name":"notepad.exe",`  
  ` "killall":true`  
  `}`
* To kill a specific process, specify its pid:  

  `{`  
  ` "name":"notepad.exe",`  
  ` "pid":12345`  
  `}`

Protected Processes
-------------------

**Processes that are monitored by Client Watchdog are protected and cannot be killed.**   

Installation adds a path to `watchdog.xml` under the key `HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\CheckPoint\Endpoint Security\DeviceAuxiliaryFramework` as a `ProtectedProcesses` entry.  

Before trying to terminate a process, its image path is searched for in `watchdog.xml`. If its image path is found, the process is treated as protected, and the operation is cancelled with a "Cannot kill protected process" error message.  

Operation results
-----------------

If all matching processes are successfully terminated, the operation status is set to "success". If at least one process could not be terminated, the operation status is set to "failed". The operation status may contain the following error descriptions:  

* "Failed to read operation parameters" - may indicate failure to parse Actions `xml` wrapping operation parameters, failure to read `json`, missing required parameters in `json`
* "Cannot kill protected process" - request to kill process that is found in `watchdog.xml`
* "Cannot access process" - failed to open handle with terminate access rights, or failed to read image path for process with matching name
* "Cannot terminate process" - TerminateProcess API call failed
* "No process found" - Could not find any process matching the filter parameters.
* "Operation partially succeeded. Terminated x of y" - Found "y" processes matching the criterion, but only "x" were successfully terminated

If the list of processes to terminate was successfully created, the Operation Output is filled with a `json` containing information about each process matching the criterion.   

For example:  
`{`  
` "name":"cptrayUI.exe",`  
` "killall":"true",`  
` "processes": [`  
` {`  
` "PID": "6668",`  
` "path": "C:\\Program Files (x86)\\CheckPoint\\Endpoint Security\\UIFramework\\Bin\\cptrayUI.exe",`  
` "result": "Cannot kill protected process"`  
` }`  
` {`  
` "PID": "12040",`  
` "path": "C:\\Users\\admin\\Desktop\\cptrayUI.exe",`  
` "result": "Operation completed successfully"`  
` }`  
` ]`  
`}`  

<br />

<br />

In the Endpoint Security Management the result is shown like this:  
![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk171910/Push_op_killProcess_result202102081219042.png)  

Log Events
----------

In the logs, the operation progress can be monitored based on the following events  
![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk171910/Push_operation_logevents202102081220353.png)

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content