Our security software AMP identified a low level security issue on GISPORTAL. There is a file called "pkill.exe" that tried to access lsass.exe and winlogin.exe. After researching it we believe file may be something GIS uses, but we aren’t sure what it's

Question

Our IT Department reached out to me this Mon AM to see if I can find out about a possible security issue. Wondering if anything I should be concerned about.

Anonymous User · Accepted Answer

Hi @AliceWilson,

Pkill.exe is an executable included with Portal for ArcGIS that is used to stop processes by their PIDs.  There are a variety of reasons this process runs:

*  A process gets hung with no activity for a specific length of time (this will vary with the process) the pkill will be invoked.
* If an illegal activity occurs in a process, pkill can be invoked to protect data.
* A process can call up pkill when it is completed.

Quarantining this executable may cause a degradation in Portal for ArcGIS' regular performance.

ElliotJones · Accepted Answer

Hi @AliceWilson,

Pkill.exe is an executable included with Portal for ArcGIS that is used to stop processes by their PIDs.  There are a variety of reasons this process runs:

*  A process gets hung with no activity for a specific length of time (this will vary with the process) the pkill will be invoked.
* If an illegal activity occurs in a process, pkill can be invoked to protect data.
* A process can call up pkill when it is completed.

Quarantining this executable may cause a degradation in Portal for ArcGIS' regular performance.