Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Impact-SecurityAgentServiceTermination.
Upgrade to ProDetect Security Agent Service Termination — EDR/AV/Backup-Agent Kill Chain Prelude to Destructive Payload in Microsoft Sentinel
Before deploying ransomware, wipers, or other destructive payloads, adversaries routinely stop or disable the security and backup agents that would otherwise detect or recover from the attack. On Windows this is done with sc.exe stop/config/delete, net stop, taskkill /f, PowerShell Stop-Service/Set-Service/Disable-Service, or WMIC service calls against EDR/AV processes (CrowdStrike Falcon, SentinelOne, Microsoft Defender, Sophos, Carbon Black, Trend Micro, McAfee/Trellix, Symantec, Cortex XDR, Cylance, Malwarebytes) and backup agents (Veeam, Acronis, Commvault, Rubrik, Druva, Cohesity). A stealthier variant bypasses sc.exe entirely and calls the Service Control Manager RPC interface (svcctl, over the \PIPE\svcctl named pipe) directly via OpenSCManagerW/ControlService Win32 API calls from a custom loader, which never shows the service name on a command line and evades command-line-only detection logic. On Linux the equivalent is systemctl stop/disable/mask/kill, service <name> stop, or a direct kill -9/pkill/killall against EDR and monitoring daemons (auditd, falcon-sensor, wazuh-agent, ossec-hids, falco, osqueryd, sophos-spl, cbagentd) and backup daemons (veeamservice, cvd, bpcd, rbs). Because this activity is almost always the immediate precursor to file encryption, mass deletion, or a wiper payload rather than an end in itself, a single stop event on one host is common IT operations noise, but two or more distinct security/backup agents stopped on the same host within a short window is a high-confidence signal that a destructive payload is about to detonate and should trigger immediate isolation ahead of encryption completing.
MITRE ATT&CK
- Tactic
- Impact
KQL Detection Query
// THREAT-Impact-SecurityAgentServiceTermination (T1489 Service Stop, Windows + Linux)
let Lookback = 2h;
let BurstWindow = 10m;
let SecurityAgentNames = dynamic([
"CSFalconService", "CSAgent", "CrowdStrike", "falcon-sensor",
"SentinelAgent", "SentinelOne", "SentinelCtl", "sentinelone",
"WinDefend", "MsMpSvc", "MsSense", "Sense", "WdNisSvc", "SecurityHealthService",
"SAVService", "SepMasterService", "Symantec", "ccSvcHst",
"McShield", "McTaskManager", "MfeEERM", "mfemms", "mfevtp",
"TmCCSF", "TmListen", "tmccsf",
"CylanceSvc", "CbDefense", "CarbonBlack", "cbdaemon", "cbagentd",
"SophosMCS", "SophosEndpointDefense", "sophos-spl",
"cyserver", "CyveraService", "CortexXDR",
"MBAMService", "Malwarebytes",
"wazuh-agent", "ossec-hids", "auditd", "falco", "osqueryd"
]);
let BackupAgentNames = dynamic([
"VeeamBackupSvc", "VeeamTransportSvc", "veeamservice",
"AcronisAgent", "acronis_agent",
"BackupExecAgentAccelerator", "BackupExecJobEngine",
"CommvaultService", "cvd",
"RubrikBackupService", "rbs",
"DruvaAgent", "cohesity", "bpcd"
]);
let WinStopTools = dynamic(["sc.exe", "net.exe", "net1.exe", "taskkill.exe", "powershell.exe", "pwsh.exe", "wmic.exe"]);
let LinuxStopTools = dynamic(["systemctl", "service", "kill", "pkill", "killall"]);
DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where FileName in~ (WinStopTools) or FileName in~ (LinuxStopTools)
| where ProcessCommandLine has_any (SecurityAgentNames) or ProcessCommandLine has_any (BackupAgentNames)
| where (FileName in~ ("sc.exe") and ProcessCommandLine has_any ("stop", "config", "delete"))
or (FileName in~ ("net.exe", "net1.exe") and ProcessCommandLine has "stop")
or (FileName in~ ("taskkill.exe") and ProcessCommandLine has_any ("/f", "/im"))
or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("Stop-Service", "Set-Service", "Disable-Service"))
or (FileName in~ ("wmic.exe") and ProcessCommandLine has_any ("stopservice", "changestartmode"))
or (FileName in~ ("systemctl") and ProcessCommandLine has_any ("stop", "disable", "kill", "mask"))
or (FileName in~ ("service") and ProcessCommandLine has "stop")
or (FileName in~ ("kill", "pkill", "killall") and ProcessCommandLine has_any ("-9", "-sigkill", "-SIGKILL"))
| extend Platform = iff(FileName in~ (WinStopTools), "Windows", "Linux")
| extend StopMethod = case(
FileName in~ ("sc.exe") and ProcessCommandLine has "stop", "sc stop",
FileName in~ ("sc.exe") and ProcessCommandLine has "config", "sc disable",
FileName in~ ("sc.exe") and ProcessCommandLine has "delete", "sc delete",
FileName in~ ("net.exe", "net1.exe"), "net stop",
FileName in~ ("taskkill.exe"), "taskkill",
FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has "Stop-Service", "PS Stop-Service",
FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has "Set-Service", "PS Set-Service",
FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has "Disable-Service", "PS Disable-Service",
FileName in~ ("wmic.exe"), "WMIC service",
FileName in~ ("systemctl"), "systemctl stop/disable/kill",
FileName in~ ("service"), "service stop",
FileName in~ ("kill", "pkill", "killall"), "SIGKILL daemon",
"other"
)
| extend TargetsSecurityAgent = ProcessCommandLine has_any (SecurityAgentNames)
| extend TargetsBackupAgent = ProcessCommandLine has_any (BackupAgentNames)
| summarize Events = make_list(pack("Timestamp", Timestamp, "FileName", FileName, "ProcessCommandLine", ProcessCommandLine,
"StopMethod", StopMethod, "TargetsSecurityAgent", TargetsSecurityAgent, "TargetsBackupAgent", TargetsBackupAgent)),
DistinctAgentsStopped = dcount(ProcessCommandLine), FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
by DeviceName, Platform, AccountName, AccountDomain, bin(Timestamp, BurstWindow)
| extend IsBurst = DistinctAgentsStopped >= 2
| mv-expand Events
| extend Timestamp = todatetime(Events.Timestamp), FileName = tostring(Events.FileName),
ProcessCommandLine = tostring(Events.ProcessCommandLine), StopMethod = tostring(Events.StopMethod),
TargetsSecurityAgent = tobool(Events.TargetsSecurityAgent), TargetsBackupAgent = tobool(Events.TargetsBackupAgent)
| project Timestamp, DeviceName, Platform, AccountName, AccountDomain, FileName, ProcessCommandLine,
StopMethod, TargetsSecurityAgent, TargetsBackupAgent, DistinctAgentsStopped, IsBurst
| sort by IsBurst desc, Timestamp descDetects EDR/AV agent and backup-agent service termination on both Windows (DeviceProcessEvents covering sc.exe, net.exe/net1.exe, taskkill.exe, powershell.exe/pwsh.exe, wmic.exe) and Linux (systemctl, service, kill, pkill, killall) hosts reporting through Microsoft Defender for Endpoint. Groups events into 10-minute buckets per device and flags IsBurst = true when two or more distinct security/backup agent stop commands fire on the same host within the window — the strongest indicator that this is a deliberate pre-encryption defense-stripping sequence rather than a single routine service restart.
Data Sources
Required Tables
False Positives & Tuning
- IT automation platforms (SCCM, Ansible, Chef, Puppet, Intune) stopping and restarting the EDR/AV agent as part of a scheduled sensor upgrade or reinstall
- Security vendor self-update/upgrade routines that briefly stop and restart their own service (e.g. CrowdStrike Falcon sensor upgrade, Defender platform update)
- Backup software maintenance windows where the backup agent service is intentionally cycled during patching
- Linux configuration management (systemd unit reloads via systemctl daemon-reload/restart) that transiently reports as a stop-then-start pair
- Decommissioning workflows where an approved change ticket removes a security or backup agent ahead of host retirement
Other platforms for THREAT-Impact-SecurityAgentServiceTermination
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulated EDR/AV Service Stop via sc.exe (Windows, Lab Only)
Expected signal: Sysmon/DeviceProcessEvents record sc.exe launched with CommandLine containing 'stop TestSentinelAgent' followed by 'config TestSentinelAgent start= disabled'; System log Event ID 7036 (stopped) and 7040 (start type changed) for the target service.
- Test 2Simulated Multi-Agent Stop Burst via PowerShell (Windows, Lab Only)
Expected signal: Two Sysmon Event ID 1 process creation events for powershell.exe with CommandLine containing 'Stop-Service' and the respective decoy service names, seconds apart on the same host.
- Test 3Simulated Linux Security Daemon Stop via systemctl (Lab Only)
Expected signal: auditd exec record and/or Sysmon-for-Linux Event ID 1 for systemctl with CommandLine containing 'stop test-wazuh-agent' and 'mask test-wazuh-agent'; systemd journal entry confirming the unit transitioned to inactive/masked.
- Test 4Simulated Direct SIGKILL of Linux Security Daemon (Lab Only)
Expected signal: auditd exec record for pkill with CommandLine containing '-9' and the decoy process name; kernel log entry for the SIGKILL delivery and process exit.
References (6)
- https://attack.mitre.org/techniques/T1489/
- https://attack.mitre.org/tactics/TA0040/
- https://attack.mitre.org/techniques/T1486/
- https://attack.mitre.org/techniques/T1562/001/
- https://learn.microsoft.com/en-us/windows/win32/services/service-control-manager
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1489/T1489.md
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Impact-SecurityAgentServiceTermination — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.