Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Impact-SecurityAgentServiceTermination.
Upgrade to ProDetect Security Agent Service Termination — EDR/AV/Backup-Agent Kill Chain Prelude to Destructive Payload in Google Chronicle
Before deploying ransomware, wipers, or other destructive payloads, adversaries routinely stop or disable the security and backup agents that would otherwise detect or recover from the attack. On Windows this is done with sc.exe stop/config/delete, net stop, taskkill /f, PowerShell Stop-Service/Set-Service/Disable-Service, or WMIC service calls against EDR/AV processes (CrowdStrike Falcon, SentinelOne, Microsoft Defender, Sophos, Carbon Black, Trend Micro, McAfee/Trellix, Symantec, Cortex XDR, Cylance, Malwarebytes) and backup agents (Veeam, Acronis, Commvault, Rubrik, Druva, Cohesity). A stealthier variant bypasses sc.exe entirely and calls the Service Control Manager RPC interface (svcctl, over the \PIPE\svcctl named pipe) directly via OpenSCManagerW/ControlService Win32 API calls from a custom loader, which never shows the service name on a command line and evades command-line-only detection logic. On Linux the equivalent is systemctl stop/disable/mask/kill, service <name> stop, or a direct kill -9/pkill/killall against EDR and monitoring daemons (auditd, falcon-sensor, wazuh-agent, ossec-hids, falco, osqueryd, sophos-spl, cbagentd) and backup daemons (veeamservice, cvd, bpcd, rbs). Because this activity is almost always the immediate precursor to file encryption, mass deletion, or a wiper payload rather than an end in itself, a single stop event on one host is common IT operations noise, but two or more distinct security/backup agents stopped on the same host within a short window is a high-confidence signal that a destructive payload is about to detonate and should trigger immediate isolation ahead of encryption completing.
MITRE ATT&CK
- Tactic
- Impact
YARA-L Detection Query
rule security_agent_service_termination {
meta:
author = "df00tech Detection Engineering"
description = "Detects EDR/AV or backup-agent service termination via CLI tooling on Windows or Linux, a common precursor to a destructive payload"
mitre_attack_tactic = "Impact"
mitre_attack_technique = "T1489"
severity = "CRITICAL"
confidence = "HIGH"
reference = "https://attack.mitre.org/techniques/T1489/"
created = "2026-07-21"
events:
$e.metadata.event_type = "PROCESS_LAUNCH"
$e.principal.process.file.full_path = /(?i)(\\sc\.exe|\\net\.exe|\\net1\.exe|\\taskkill\.exe|\\powershell\.exe|\\pwsh\.exe|\\wmic\.exe|\/systemctl|\/service|\/kill|\/pkill|\/killall)$/
$e.target.process.command_line = /(?i)(csfalconservice|sentinelagent|windefend|mssense|savservice|mcshield|tmccsf|cylancesvc|carbonblack|sophosmcs|wazuh-agent|auditd|veeambackupsvc|acronisagent|commvaultservice)/
$hostname = $e.principal.hostname
$user = $e.principal.user.userid
$cmdline = $e.target.process.command_line
condition:
$e
}Chronicle YARA-L 2.0 rule matching PROCESS_LAUNCH UDM events where a known stop-tool (Windows or Linux) is invoked with a command line referencing a known EDR/AV or backup-agent name. Correlate on $hostname across matches within a 10-minute window in the Chronicle rule aggregation layer to reproduce the 2+ distinct-agent burst signal used by the primary detections.
Data Sources
Required Tables
False Positives & Tuning
- IT automation and patch-management tools cycling the agent during scheduled maintenance
- Security vendor self-update routines that briefly stop and restart their own service
- Backup software maintenance windows that intentionally cycle the backup agent
Other platforms for THREAT-Impact-SecurityAgentServiceTermination
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulated EDR/AV Service Stop via sc.exe (Windows, Lab Only)
Expected signal: Sysmon/DeviceProcessEvents record sc.exe launched with CommandLine containing 'stop TestSentinelAgent' followed by 'config TestSentinelAgent start= disabled'; System log Event ID 7036 (stopped) and 7040 (start type changed) for the target service.
- Test 2Simulated Multi-Agent Stop Burst via PowerShell (Windows, Lab Only)
Expected signal: Two Sysmon Event ID 1 process creation events for powershell.exe with CommandLine containing 'Stop-Service' and the respective decoy service names, seconds apart on the same host.
- Test 3Simulated Linux Security Daemon Stop via systemctl (Lab Only)
Expected signal: auditd exec record and/or Sysmon-for-Linux Event ID 1 for systemctl with CommandLine containing 'stop test-wazuh-agent' and 'mask test-wazuh-agent'; systemd journal entry confirming the unit transitioned to inactive/masked.
- Test 4Simulated Direct SIGKILL of Linux Security Daemon (Lab Only)
Expected signal: auditd exec record for pkill with CommandLine containing '-9' and the decoy process name; kernel log entry for the SIGKILL delivery and process exit.
References (6)
- https://attack.mitre.org/techniques/T1489/
- https://attack.mitre.org/tactics/TA0040/
- https://attack.mitre.org/techniques/T1486/
- https://attack.mitre.org/techniques/T1562/001/
- https://learn.microsoft.com/en-us/windows/win32/services/service-control-manager
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1489/T1489.md
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Impact-SecurityAgentServiceTermination — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.