T1211 Elastic Security · Elastic

Detect Exploitation for Defense Evasion in Elastic Security

Adversaries may exploit a system or application vulnerability to bypass security features. Exploitation of a vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Vulnerabilities may exist in defensive security software that can be used to disable or circumvent them. Adversaries may have prior knowledge through reconnaissance that security software exists within an environment or they may perform checks during or shortly after the system is compromised for Security Software Discovery. There have also been examples of vulnerabilities in public cloud infrastructure and SaaS applications that may bypass defense boundaries, evade security logs, or deploy hidden infrastructure.

MITRE ATT&CK

Tactic
Defense Evasion
Technique
T1211 Exploitation for Defense Evasion
Canonical reference
https://attack.mitre.org/techniques/T1211/

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by host.name with maxspan=5m
[
  process where event.type == "start" and
  process.parent.name : (
    "MsMpEng.exe", "MsSense.exe", "SenseCncProxy.exe", "SenseIR.exe",
    "csagent.exe", "CSFalconService.exe", "CSFalconContainer.exe",
    "SentinelAgent.exe", "SentinelServiceHost.exe", "SentinelStaticEngine.exe",
    "CylanceSvc.exe", "CylanceUI.exe",
    "cb.exe", "CbDefense.exe", "CbDefenseService.exe",
    "mbam.exe", "MBAMService.exe",
    "sophosssp.exe", "SophosSafestore.exe", "SAVService.exe",
    "avp.exe", "avpui.exe",
    "avgnt.exe", "avguard.exe",
    "aswBoot.exe", "AvastSvc.exe"
  ) and
  process.name : (
    "cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
    "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe",
    "bitsadmin.exe", "msiexec.exe", "csc.exe", "msbuild.exe",
    "wmic.exe", "net.exe", "net1.exe", "sc.exe"
  )
] by process.parent.pid

OR

any where event.category == "process" and event.action == "process_accessed" and
  process.name : (
    "MsMpEng.exe", "MsSense.exe", "SenseCncProxy.exe", "csagent.exe",
    "CSFalconService.exe", "SentinelAgent.exe", "CylanceSvc.exe",
    "cb.exe", "CbDefense.exe", "mbam.exe", "sophosssp.exe",
    "SAVService.exe", "avp.exe", "avgnt.exe", "AvastSvc.exe"
  ) and
  not process.parent.name : (
    "System", "svchost.exe", "lsass.exe", "csrss.exe",
    "wininit.exe", "services.exe", "smss.exe", "WerFault.exe"
  )

OR

any where event.category == "process" and event.code : ("7034", "7035", "7036", "7045") and
  process.name : (
    "MsMpEng.exe", "MsSense.exe", "SenseCncProxy.exe", "csagent.exe",
    "CSFalconService.exe", "SentinelAgent.exe", "CylanceSvc.exe",
    "cb.exe", "CbDefense.exe", "mbam.exe", "sophosssp.exe",
    "SAVService.exe", "avp.exe", "avgnt.exe", "AvastSvc.exe"
  )
critical severity high confidence

Detects exploitation of security software for defense evasion via three signals: (1) a security process spawning a suspicious child process indicating post-exploitation code execution, (2) a non-system process opening a security process with elevated access rights indicating pre-exploitation access, and (3) a security service being unexpectedly modified or stopped indicating crash-based exploitation or forced termination.

Data Sources

Elastic Endpoint SecurityWindows Sysmon (via Winlogbeat)Windows Event Logs (System log via Winlogbeat)

Required Tables

logs-endpoint.events.process-*logs-endpoint.events.security-*winlogbeat-*

False Positives & Tuning

  • Legitimate security software updates or self-healing mechanisms may spawn cmd.exe or msiexec.exe during patch application
  • Security vendor diagnostic or forensic tools may open other security processes with elevated access for interoperability or health checks
  • Security service restarts during scheduled maintenance windows may trigger service stop/start events (EventCode 7036)
Download portable Sigma rule (.yml)

Other platforms for T1211

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate Security Process Spawning Command Shell

    Expected signal: Sysmon Event ID 1: Process Create with Image=cmd.exe, ParentImage=powershell.exe (or the process running the test). Security Event ID 4688 if command line auditing is enabled. The detection signal 'SecuritySoftwareSpawnedSuspiciousChild' may not fire unless the initiating process name matches the security process list — use this test to validate the detection logic by temporarily adding 'powershell.exe' to the SecurityProcesses list in a test environment.

  2. Test 2Open Handle to Windows Defender Process (ProcessAccess Simulation)

    Expected signal: Sysmon Event ID 10 (ProcessAccess): SourceImage=powershell.exe, TargetImage=C:\ProgramData\Microsoft\Windows Defender\Platform\<version>\MsMpEng.exe, GrantedAccess=0x0400. Note: Windows Defender is Protected Process Light (PPL) — the OpenProcess call may be denied, but Sysmon still logs the attempt with CallTrace data showing the call stack.

  3. Test 3Security Service State Query and Stop Simulation (Non-Destructive)

    Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'sc query WinDefend' and 'sc query Sense'. Security Event ID 4688 (if enabled). Sysmon Event ID 1 for wmic.exe with CommandLine containing 'service where name'. These are the same reconnaissance commands used by threat actors (including APT28 tooling) to identify security software before exploitation.

  4. Test 4Exploit Artifact Simulation — Security Service Crash via WerFault

    Expected signal: Sysmon Event ID 1: Process Create for werfault.exe with command line containing '-p 0'. Application Event Log queries via wevtutil generate additional Sysmon Event ID 1 entries for wevtutil.exe. The WerFault invocation with PID 0 will fail but the process creation telemetry is generated and matches patterns seen when security software is exploited and crashes.

Last updated: 2026-04-19 Research depth: deep
References (9)

Unlock Pro Content

Get the full detection package for T1211 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Related Techniques

T1518.001Security Software DiscoveryT1562.001Disable or Modify ToolsT1562.004Disable or Modify System FirewallT1055Process InjectionT1574Hijack Execution FlowT1190Exploit Public-Facing ApplicationT1203Exploitation for Client ExecutionT1068Exploitation for Privilege Escalation

Same Tactic: Defense Evasion

Popular Detections