Service Stop — Security Agent Service Termination — EDR/AV/Backup-Agent Kill Chain Prelude to Destructive Payload

// THREAT-Impact-SecurityAgentServiceTermination (T1489 Service Stop, Windows + Linux)
let Lookback = 2h;
let BurstWindow = 10m;
let SecurityAgentNames = dynamic([
  "CSFalconService", "CSAgent", "CrowdStrike", "falcon-sensor",
  "SentinelAgent", "SentinelOne", "SentinelCtl", "sentinelone",
  "WinDefend", "MsMpSvc", "MsSense", "Sense", "WdNisSvc", "SecurityHealthService",
  "SAVService", "SepMasterService", "Symantec", "ccSvcHst",
  "McShield", "McTaskManager", "MfeEERM", "mfemms", "mfevtp",
  "TmCCSF", "TmListen", "tmccsf",
  "CylanceSvc", "CbDefense", "CarbonBlack", "cbdaemon", "cbagentd",
  "SophosMCS", "SophosEndpointDefense", "sophos-spl",
  "cyserver", "CyveraService", "CortexXDR",
  "MBAMService", "Malwarebytes",
  "wazuh-agent", "ossec-hids", "auditd", "falco", "osqueryd"
]);
let BackupAgentNames = dynamic([
  "VeeamBackupSvc", "VeeamTransportSvc", "veeamservice",
  "AcronisAgent", "acronis_agent",
  "BackupExecAgentAccelerator", "BackupExecJobEngine",
  "CommvaultService", "cvd",
  "RubrikBackupService", "rbs",
  "DruvaAgent", "cohesity", "bpcd"
]);
let WinStopTools = dynamic(["sc.exe", "net.exe", "net1.exe", "taskkill.exe", "powershell.exe", "pwsh.exe", "wmic.exe"]);
let LinuxStopTools = dynamic(["systemctl", "service", "kill", "pkill", "killall"]);
DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where FileName in~ (WinStopTools) or FileName in~ (LinuxStopTools)
| where ProcessCommandLine has_any (SecurityAgentNames) or ProcessCommandLine has_any (BackupAgentNames)
| where (FileName in~ ("sc.exe") and ProcessCommandLine has_any ("stop", "config", "delete"))
    or (FileName in~ ("net.exe", "net1.exe") and ProcessCommandLine has "stop")
    or (FileName in~ ("taskkill.exe") and ProcessCommandLine has_any ("/f", "/im"))
    or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("Stop-Service", "Set-Service", "Disable-Service"))
    or (FileName in~ ("wmic.exe") and ProcessCommandLine has_any ("stopservice", "changestartmode"))
    or (FileName in~ ("systemctl") and ProcessCommandLine has_any ("stop", "disable", "kill", "mask"))
    or (FileName in~ ("service") and ProcessCommandLine has "stop")
    or (FileName in~ ("kill", "pkill", "killall") and ProcessCommandLine has_any ("-9", "-sigkill", "-SIGKILL"))
| extend Platform = iff(FileName in~ (WinStopTools), "Windows", "Linux")
| extend StopMethod = case(
    FileName in~ ("sc.exe") and ProcessCommandLine has "stop", "sc stop",
    FileName in~ ("sc.exe") and ProcessCommandLine has "config", "sc disable",
    FileName in~ ("sc.exe") and ProcessCommandLine has "delete", "sc delete",
    FileName in~ ("net.exe", "net1.exe"), "net stop",
    FileName in~ ("taskkill.exe"), "taskkill",
    FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has "Stop-Service", "PS Stop-Service",
    FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has "Set-Service", "PS Set-Service",
    FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has "Disable-Service", "PS Disable-Service",
    FileName in~ ("wmic.exe"), "WMIC service",
    FileName in~ ("systemctl"), "systemctl stop/disable/kill",
    FileName in~ ("service"), "service stop",
    FileName in~ ("kill", "pkill", "killall"), "SIGKILL daemon",
    "other"
  )
| extend TargetsSecurityAgent = ProcessCommandLine has_any (SecurityAgentNames)
| extend TargetsBackupAgent = ProcessCommandLine has_any (BackupAgentNames)
| summarize Events = make_list(pack("Timestamp", Timestamp, "FileName", FileName, "ProcessCommandLine", ProcessCommandLine,
      "StopMethod", StopMethod, "TargetsSecurityAgent", TargetsSecurityAgent, "TargetsBackupAgent", TargetsBackupAgent)),
      DistinctAgentsStopped = dcount(ProcessCommandLine), FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
      by DeviceName, Platform, AccountName, AccountDomain, bin(Timestamp, BurstWindow)
| extend IsBurst = DistinctAgentsStopped >= 2
| mv-expand Events
| extend Timestamp = todatetime(Events.Timestamp), FileName = tostring(Events.FileName),
         ProcessCommandLine = tostring(Events.ProcessCommandLine), StopMethod = tostring(Events.StopMethod),
         TargetsSecurityAgent = tobool(Events.TargetsSecurityAgent), TargetsBackupAgent = tobool(Events.TargetsBackupAgent)
| project Timestamp, DeviceName, Platform, AccountName, AccountDomain, FileName, ProcessCommandLine,
         StopMethod, TargetsSecurityAgent, TargetsBackupAgent, DistinctAgentsStopped, IsBurst
| sort by IsBurst desc, Timestamp desc

index=wineventlog OR index=linux sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="linux_secure" OR sourcetype="syslog" EventCode=1 OR sourcetype="syslog"
  (Image="*\\sc.exe" OR Image="*\\net.exe" OR Image="*\\net1.exe" OR Image="*\\taskkill.exe"
   OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wmic.exe"
   OR Image="*/systemctl" OR Image="*/service" OR Image="*/kill" OR Image="*/pkill" OR Image="*/killall"
   OR process="systemctl*" OR process="kill*" OR process="pkill*")
| eval cl=lower(coalesce(CommandLine, process_exec))
| eval Platform=if(match(Image, "\.exe$"), "Windows", "Linux")
| eval TargetsSecurityAgent=if(match(cl, "(csfalconservice|csagent|crowdstrike|falcon-sensor|sentinelagent|sentinelone|windefend|msmpeng|mssense|sense|wdnissvc|securityhealthservice|savservice|sepmasterservice|symantec|mcshield|mfemms|mfevtp|tmccsf|tmlisten|cylancesvc|cbdefense|carbonblack|cbdaemon|cbagentd|sophosmcs|sophos-spl|cyserver|cyveraservice|cortexxdr|mbamservice|malwarebytes|wazuh-agent|ossec-hids|auditd|falco|osqueryd)"), 1, 0)
| eval TargetsBackupAgent=if(match(cl, "(veeambackupsvc|veeamtransportsvc|veeamservice|acronisagent|acronis_agent|backupexecagent|backupexecjobengine|commvaultservice|cvd|rubrikbackupservice|rbs|druvaagent|cohesity|bpcd)"), 1, 0)
| where TargetsSecurityAgent=1 OR TargetsBackupAgent=1
| eval StopMethod=case(
    match(Image, "sc\.exe") AND match(cl, "\bstop\b"), "sc stop",
    match(Image, "sc\.exe") AND match(cl, "config"), "sc disable",
    match(Image, "sc\.exe") AND match(cl, "\bdelete\b"), "sc delete",
    match(Image, "net1?\.exe"), "net stop",
    match(Image, "taskkill\.exe"), "taskkill",
    match(Image, "powers?hell\.exe") AND match(cl, "stop-service"), "PS Stop-Service",
    match(Image, "powers?hell\.exe") AND match(cl, "set-service"), "PS Set-Service",
    match(Image, "powers?hell\.exe") AND match(cl, "disable-service"), "PS Disable-Service",
    match(Image, "wmic\.exe"), "WMIC service",
    match(cl, "systemctl") AND match(cl, "(stop|disable|kill|mask)"), "systemctl stop/disable/kill",
    match(cl, "^service") AND match(cl, "stop"), "service stop",
    match(cl, "(kill|pkill|killall)") AND match(cl, "(-9|-sigkill)"), "SIGKILL daemon",
    1=1, "other"
  )
| where StopMethod != "other"
| bin _time span=10m
| stats count as EventCount, dc(cl) as DistinctAgentsStopped, values(cl) as SampleCommands by host, _time, Platform
| eval IsBurst=if(DistinctAgentsStopped>=2, "YES", "NO")
| table _time, host, Platform, StopMethod, DistinctAgentsStopped, IsBurst, SampleCommands
| sort - IsBurst, - _time

process where event.type == "start" and (
  (process.name : ("sc.exe", "net.exe", "net1.exe", "taskkill.exe", "powershell.exe", "pwsh.exe", "wmic.exe") or
   process.name : ("systemctl", "service", "kill", "pkill", "killall")) and
  process.command_line : ("*CSFalconService*", "*SentinelAgent*", "*WinDefend*", "*MsSense*", "*SAVService*",
    "*McShield*", "*TmCCSF*", "*CylanceSvc*", "*CarbonBlack*", "*cbagentd*", "*SophosMCS*", "*sophos-spl*",
    "*wazuh-agent*", "*ossec-hids*", "*auditd*", "*falco*", "*osqueryd*",
    "*VeeamBackupSvc*", "*veeamservice*", "*AcronisAgent*", "*CommvaultService*", "*cvd*", "*RubrikBackupService*", "*DruvaAgent*")
)

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  sourceip AS HostIP,
  "Process Name" AS ProcessName,
  "Command" AS CommandLine,
  CASE
    WHEN LOWER("Command") LIKE '%stop%' AND LOWER("Process Name") LIKE '%sc.exe%' THEN 'sc stop'
    WHEN LOWER("Process Name") LIKE '%net%.exe%' THEN 'net stop'
    WHEN LOWER("Process Name") LIKE '%taskkill.exe%' THEN 'taskkill'
    WHEN LOWER("Process Name") LIKE '%systemctl%' THEN 'systemctl stop/disable/kill'
    WHEN LOWER("Process Name") LIKE '%pkill%' OR LOWER("Process Name") LIKE '%kill%' THEN 'SIGKILL daemon'
    ELSE 'other'
  END AS StopMethod
FROM events
WHERE
  (
    LOWER("Process Name") LIKE '%sc.exe%' OR LOWER("Process Name") LIKE '%net.exe%' OR LOWER("Process Name") LIKE '%net1.exe%'
    OR LOWER("Process Name") LIKE '%taskkill.exe%' OR LOWER("Process Name") LIKE '%powershell.exe%' OR LOWER("Process Name") LIKE '%wmic.exe%'
    OR LOWER("Process Name") LIKE '%systemctl%' OR LOWER("Process Name") LIKE '%service%' OR LOWER("Process Name") LIKE '%kill%'
  )
  AND (
    LOWER("Command") LIKE '%csfalconservice%' OR LOWER("Command") LIKE '%sentinelagent%' OR LOWER("Command") LIKE '%windefend%'
    OR LOWER("Command") LIKE '%mssense%' OR LOWER("Command") LIKE '%savservice%' OR LOWER("Command") LIKE '%mcshield%'
    OR LOWER("Command") LIKE '%tmccsf%' OR LOWER("Command") LIKE '%cylancesvc%' OR LOWER("Command") LIKE '%carbonblack%'
    OR LOWER("Command") LIKE '%sophosmcs%' OR LOWER("Command") LIKE '%wazuh-agent%' OR LOWER("Command") LIKE '%auditd%'
    OR LOWER("Command") LIKE '%veeambackupsvc%' OR LOWER("Command") LIKE '%acronisagent%' OR LOWER("Command") LIKE '%commvaultservice%'
  )
ORDER BY devicetime DESC
LAST 24 HOURS

_sourceCategory="windows/sysmon" OR _sourceCategory="linux/auditd" OR _sourceCategory="linux/syslog"
| where EventID = "1" OR _sourceCategory matches "linux*"
| where (Image matches "*\\sc.exe" OR Image matches "*\\net.exe" OR Image matches "*\\net1.exe"
  OR Image matches "*\\taskkill.exe" OR Image matches "*\\powershell.exe" OR Image matches "*\\pwsh.exe" OR Image matches "*\\wmic.exe"
  OR Image matches "*/systemctl" OR Image matches "*/service" OR Image matches "*/kill" OR Image matches "*/pkill" OR Image matches "*/killall")
| eval CommandLineLower = toLowerCase(CommandLine)
| where CommandLineLower matches "*csfalconservice*" or CommandLineLower matches "*sentinelagent*" or CommandLineLower matches "*windefend*"
  or CommandLineLower matches "*mssense*" or CommandLineLower matches "*savservice*" or CommandLineLower matches "*mcshield*"
  or CommandLineLower matches "*tmccsf*" or CommandLineLower matches "*cylancesvc*" or CommandLineLower matches "*carbonblack*"
  or CommandLineLower matches "*sophosmcs*" or CommandLineLower matches "*wazuh-agent*" or CommandLineLower matches "*auditd*"
  or CommandLineLower matches "*veeambackupsvc*" or CommandLineLower matches "*acronisagent*" or CommandLineLower matches "*commvaultservice*"
| eval Platform = if(Image matches "*.exe", "Windows", "Linux")
| timeslice 10m
| stats dc(CommandLineLower) as DistinctAgentsStopped, values(CommandLineLower) as SampleCommands by Computer, _timeslice, Platform
| where DistinctAgentsStopped >= 1
| eval IsBurst = if(DistinctAgentsStopped >= 2, "YES", "NO")
| sort by DistinctAgentsStopped desc

rule security_agent_service_termination {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects EDR/AV or backup-agent service termination via CLI tooling on Windows or Linux, a common precursor to a destructive payload"
    mitre_attack_tactic = "Impact"
    mitre_attack_technique = "T1489"
    severity = "CRITICAL"
    confidence = "HIGH"
    reference = "https://attack.mitre.org/techniques/T1489/"
    created = "2026-07-21"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.process.file.full_path = /(?i)(\\sc\.exe|\\net\.exe|\\net1\.exe|\\taskkill\.exe|\\powershell\.exe|\\pwsh\.exe|\\wmic\.exe|\/systemctl|\/service|\/kill|\/pkill|\/killall)$/
    $e.target.process.command_line = /(?i)(csfalconservice|sentinelagent|windefend|mssense|savservice|mcshield|tmccsf|cylancesvc|carbonblack|sophosmcs|wazuh-agent|auditd|veeambackupsvc|acronisagent|commvaultservice)/
    $hostname = $e.principal.hostname
    $user = $e.principal.user.userid
    $cmdline = $e.target.process.command_line

  condition:
    $e
}

#event_simpleName = ProcessRollup2
| FileName = /^(sc|net|net1|taskkill|powershell|pwsh|wmic|systemctl|service|kill|pkill|killall)(\.exe)?$/i
| CommandLine = /(?i)(csfalconservice|sentinelagent|windefend|mssense|savservice|mcshield|tmccsf|cylancesvc|carbonblack|cbagentd|sophosmcs|sophos-spl|wazuh-agent|ossec-hids|auditd|falco|osqueryd|veeambackupsvc|veeamservice|acronisagent|commvaultservice|cvd|rubrikbackupservice|rbs|druvaagent|cohesity)/
| eval StopMethod = case(
    FileName = /^sc\.exe$/i AND CommandLine = /(?i)\bstop\b/, "sc stop",
    FileName = /^sc\.exe$/i AND CommandLine = /(?i)config/, "sc disable",
    FileName = /^net1?\.exe$/i, "net stop",
    FileName = /^taskkill\.exe$/i, "taskkill",
    FileName = /^(powershell|pwsh)\.exe$/i AND CommandLine = /(?i)stop-service/, "PS Stop-Service",
    FileName = /^wmic\.exe$/i, "WMIC service",
    FileName = /^systemctl$/i, "systemctl stop/disable/kill",
    FileName = /^service$/i, "service stop",
    FileName = /^(kill|pkill|killall)$/i AND CommandLine = /(?i)(-9|-sigkill)/, "SIGKILL daemon",
    "other"
  )
| where StopMethod != "other"
| groupBy([ComputerName, UserName, FileName, CommandLine, StopMethod], function=([min(ContextTimeStamp_decimal, as=FirstSeen), max(ContextTimeStamp_decimal, as=LastSeen), count(as=EventCount)]))
| sort(FirstSeen, order=desc)