Kenyan troops are combing a besieged mall in Nairobi, as terrorists who attacked the four-storey building said they are still holding hostages inside.

The al-Qaida-linked rebel group al-Shabaab said Islamist militants who laid siege to the Westgate shopping centre are holding their ground on the fourth day of a deadly standoff with Kenya's security forces.

At least 62 people have been killed and 170 injured in the attack. Among the victims are six Britons, the UK Foreign and Commonwealth Office said.

Al-Shabaab, a Somalia-based terrorist organisation, used one of its various Twitter accounts to post a picture of two of its fighters inside the mall and brag about the siege.

"The hostages who were being held by the Mujahideen inside #Westgate are still alive, looking quite disconcerted but, nevertheless, alive," al-Shabaab tweeted.

Earlier Kenyan officials said that almost all of the hostages had been freed by security forces that were in full control of the building.

A security expert with contacts inside the mall told AP that there were at least 30 hostages when the assault began Saturday and at least 10 were believed to be still inside. The Red Cross said 51 people are missing.

An explosion and sporadic gunfire could be heard from the upscale shopping centre on Tuesday, signalling fighting is still ongoing.

Kenya's police said they are carrying out a clean-up of explosives that had been set up by the terrorists inside the building.

Security forces said 10 militants have been arrested and three have been killed, while "one or two" militants are barricaded in or around a casino on one of the upper floors of the complex.

Other Security sources put the militants' death toll at 6.

A 10 to 20-strong commando unit armed with grenades and assault rifles is believed to have carried out the attack.

Witnesses that escaped from the siege said the attackers were all young and spoke English.

Al-Shabaab is renowned for recruiting foreign and particularly western fighters.

Kenya's foreign minister said "two or three" Americans and a British woman were among the attackers.

Amina Mohamed told US TV programme PBS Newshour that the Americans were 18 or 19 years old and came from "Minnesota and one other place".

The British woman is largely believed to be Samantha Lewthwaite, 29, the widow of one of the 7/7 London bombers, who has been on the run in East Africa since she allegedly took part in a plot to stage a bomb attack in the city of Mombasa, Kenya in 2011.

UK Home Secretary Theresa May has said she cannot confirm or deny that a British woman was involved in the Westgate attack.

"I'm aware that there have been reports of a British woman being involved, but until we have seen the investigations completed, it is not possible to give further details to confirm or deny that issue," May said.

Earlier Kenyan interior minister Joseph Lenku had said that all of the terrorists were men, but some were dressed as women.