topic Re: Our security software AMP identified a low level security issue on GISPORTAL. There is a file called "pkill.exe" that tried to access ls in ArcGIS Enterprise Portal Questions

Our security software AMP identified a low level security issue on GISPORTAL. There is a file called "pkill.exe" that tried to access lsass.exe and winlogin.exe. After researching it we believe file may be something GIS uses, but we aren’t sure what it's

AliceWilson — Mon, 26 Oct 2020 14:40:58 GMT

Our IT Department reached out to me this Mon AM to see if I can find out about a possible security issue. Wondering if anything I should be concerned about.

Re: Our security software AMP identified a low level security issue on GISPORTAL. There is a file called "pkill.exe" that tried to access ls

Anonymous User — Wed, 18 Nov 2020 22:04:18 GMT

Hi @AliceWilson,

Pkill.exe is an executable included with Portal for ArcGIS that is used to stop processes by their PIDs. There are a variety of reasons this process runs:

A process gets hung with no activity for a specific length of time (this will vary with the process) the pkill will be invoked.
If an illegal activity occurs in a process, pkill can be invoked to protect data.
A process can call up pkill when it is completed.

Quarantining this executable may cause a degradation in Portal for ArcGIS' regular performance.

Re: Our security software AMP identified a low level security issue on GISPORTAL. There is a file called "pkill.exe" that tried to access ls

AliceWilson — Thu, 19 Nov 2020 12:31:12 GMT

Thanks Elliot!

I have been searching for an answer and reaching out to ESRI staff with no success. This is what I was thinking, but thanks for verifying!

Re: Our security software AMP identified a low level security issue on GISPORTAL. There is a file called "pkill.exe" that tried to access ls

ElliotJones — Fri, 20 Nov 2020 00:24:29 GMT

Hi @AliceWilson,

Pkill.exe is an executable included with Portal for ArcGIS that is used to stop processes by their PIDs. There are a variety of reasons this process runs:

A process gets hung with no activity for a specific length of time (this will vary with the process) the pkill will be invoked.
If an illegal activity occurs in a process, pkill can be invoked to protect data.
A process can call up pkill when it is completed.

Quarantining this executable may cause a degradation in Portal for ArcGIS' regular performance.