After successfully compromising a remote host, a security consultant notices an endpoint protection software is running on the host. Which of the following commands would be best for the consultant…

The correct answer is A. taskkill /PID /T /F. The taskkill command is used in Windows to terminate tasks by process ID (PID) or image name (IM). The correct command to terminate a specified process and any child processes which were started by it uses the /T flag, and the /F flag is used to force terminate the process…

Post-exploitation and lateral movement

Question

After successfully compromising a remote host, a security consultant notices an endpoint protection software is running on the host. Which of the following commands would be best for the consultant to use to terminate the protection software and its child processes?

Options

Ataskkill /PID /T /F
Btaskkill /PID /IM /F
Ctaskkill /PID /S /U
Dtaskkill /PID /F /P

How the community answered

(56 responses)

A
80% (45)
B
13% (7)
C
2% (1)
D
5% (3)

Explanation

The taskkill command is used in Windows to terminate tasks by process ID (PID) or image name (IM). The correct command to terminate a specified process and any child processes which were started by it uses the /T flag, and the /F flag is used to force terminate the process. Therefore, taskkill /PID /T /F is the correct syntax to terminate the endpoint protection software and its child

Topics

#taskkill#Post-exploitation#Endpoint protection evasion#Windows commands

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice