-
-
Notifications
You must be signed in to change notification settings - Fork 1k
KillDate
infosec guy edited this page Apr 2, 2023
·
2 revisions
You can set the KillDate directly on the profile:
Http {
Name = "foo"
KillDate = "2023-10-02 15:04:05"
...
}
Smb {
Name = "bar"
KillDate = "2023-10-02 15:04:05"
...
}
Also, you can set or update it dynamically by running: config killdate 2023-10-02 15:04:05
If you want to remove the killdate entirely, run: config killdate 0
Always remember that the KillDate is interpreted as UTC, and NOT in any other timezone.
If an agent with a KillDate that has already passed is executed, it will terminate execution immediately and won't even try to contact the teamserver.
Finally, when a KillDate is reached, the main thread will call RtlExitUserThread
, which is not necessarily what you want on all scenarios.