power-word-stun

To freeze a running process without killing it, you need a suspension mechanism like SIGSTOP that halts execution while preserving the process state in memory. This allows the target to remain alive for investigation or later resumption.

The best way to contain a compromised process during an incident is an emergency suspension that stops activity immediately. A hard freeze halts further damage while preserving the execution state as evidence for analysis.

Yes, you can resume a process after sending a SIGSTOP signal. The process is resumption-ready, meaning it can be unfrozen and continued from the exact point of interruption when appropriate.

Freezing a process with SIGSTOP preserves its memory state completely. The hard freeze mechanism suspends execution but retains all memory and state data, ensuring nothing is lost during the intervention.

You should use a process freeze instead of termination when destruction is unnecessary but activity must stop, such as during safety incidents, account freezes, or investigations requiring preserved execution state.

State preservation across sessions works by capturing and retaining the process execution state through standard agent capabilities. This ensures the frozen process can be restored and resumed later without losing its context.