Skip to content

KillDate

infosec guy edited this page Apr 2, 2023 · 2 revisions

You can set the KillDate directly on the profile:

    Http {
        Name     = "foo"
        KillDate = "2023-10-02 15:04:05"
        ...
    }

    Smb {
        Name     = "bar"
        KillDate = "2023-10-02 15:04:05"
        ...
    }

Also, you can set or update it dynamically by running: config killdate 2023-10-02 15:04:05

If you want to remove the killdate entirely, run: config killdate 0

Always remember that the KillDate is interpreted as UTC, and NOT in any other timezone.

If an agent with a KillDate that has already passed is executed, it will terminate execution immediately and won't even try to contact the teamserver.

Finally, when a KillDate is reached, the main thread will call RtlExitUserThread, which is not necessarily what you want on all scenarios.

Clone this wiki locally