Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Impact-SecurityAgentServiceTermination.
Upgrade to ProDetect Security Agent Service Termination — EDR/AV/Backup-Agent Kill Chain Prelude to Destructive Payload in Splunk
Before deploying ransomware, wipers, or other destructive payloads, adversaries routinely stop or disable the security and backup agents that would otherwise detect or recover from the attack. On Windows this is done with sc.exe stop/config/delete, net stop, taskkill /f, PowerShell Stop-Service/Set-Service/Disable-Service, or WMIC service calls against EDR/AV processes (CrowdStrike Falcon, SentinelOne, Microsoft Defender, Sophos, Carbon Black, Trend Micro, McAfee/Trellix, Symantec, Cortex XDR, Cylance, Malwarebytes) and backup agents (Veeam, Acronis, Commvault, Rubrik, Druva, Cohesity). A stealthier variant bypasses sc.exe entirely and calls the Service Control Manager RPC interface (svcctl, over the \PIPE\svcctl named pipe) directly via OpenSCManagerW/ControlService Win32 API calls from a custom loader, which never shows the service name on a command line and evades command-line-only detection logic. On Linux the equivalent is systemctl stop/disable/mask/kill, service <name> stop, or a direct kill -9/pkill/killall against EDR and monitoring daemons (auditd, falcon-sensor, wazuh-agent, ossec-hids, falco, osqueryd, sophos-spl, cbagentd) and backup daemons (veeamservice, cvd, bpcd, rbs). Because this activity is almost always the immediate precursor to file encryption, mass deletion, or a wiper payload rather than an end in itself, a single stop event on one host is common IT operations noise, but two or more distinct security/backup agents stopped on the same host within a short window is a high-confidence signal that a destructive payload is about to detonate and should trigger immediate isolation ahead of encryption completing.
MITRE ATT&CK
- Tactic
- Impact
SPL Detection Query
index=wineventlog OR index=linux sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="linux_secure" OR sourcetype="syslog" EventCode=1 OR sourcetype="syslog"
(Image="*\\sc.exe" OR Image="*\\net.exe" OR Image="*\\net1.exe" OR Image="*\\taskkill.exe"
OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wmic.exe"
OR Image="*/systemctl" OR Image="*/service" OR Image="*/kill" OR Image="*/pkill" OR Image="*/killall"
OR process="systemctl*" OR process="kill*" OR process="pkill*")
| eval cl=lower(coalesce(CommandLine, process_exec))
| eval Platform=if(match(Image, "\.exe$"), "Windows", "Linux")
| eval TargetsSecurityAgent=if(match(cl, "(csfalconservice|csagent|crowdstrike|falcon-sensor|sentinelagent|sentinelone|windefend|msmpeng|mssense|sense|wdnissvc|securityhealthservice|savservice|sepmasterservice|symantec|mcshield|mfemms|mfevtp|tmccsf|tmlisten|cylancesvc|cbdefense|carbonblack|cbdaemon|cbagentd|sophosmcs|sophos-spl|cyserver|cyveraservice|cortexxdr|mbamservice|malwarebytes|wazuh-agent|ossec-hids|auditd|falco|osqueryd)"), 1, 0)
| eval TargetsBackupAgent=if(match(cl, "(veeambackupsvc|veeamtransportsvc|veeamservice|acronisagent|acronis_agent|backupexecagent|backupexecjobengine|commvaultservice|cvd|rubrikbackupservice|rbs|druvaagent|cohesity|bpcd)"), 1, 0)
| where TargetsSecurityAgent=1 OR TargetsBackupAgent=1
| eval StopMethod=case(
match(Image, "sc\.exe") AND match(cl, "\bstop\b"), "sc stop",
match(Image, "sc\.exe") AND match(cl, "config"), "sc disable",
match(Image, "sc\.exe") AND match(cl, "\bdelete\b"), "sc delete",
match(Image, "net1?\.exe"), "net stop",
match(Image, "taskkill\.exe"), "taskkill",
match(Image, "powers?hell\.exe") AND match(cl, "stop-service"), "PS Stop-Service",
match(Image, "powers?hell\.exe") AND match(cl, "set-service"), "PS Set-Service",
match(Image, "powers?hell\.exe") AND match(cl, "disable-service"), "PS Disable-Service",
match(Image, "wmic\.exe"), "WMIC service",
match(cl, "systemctl") AND match(cl, "(stop|disable|kill|mask)"), "systemctl stop/disable/kill",
match(cl, "^service") AND match(cl, "stop"), "service stop",
match(cl, "(kill|pkill|killall)") AND match(cl, "(-9|-sigkill)"), "SIGKILL daemon",
1=1, "other"
)
| where StopMethod != "other"
| bin _time span=10m
| stats count as EventCount, dc(cl) as DistinctAgentsStopped, values(cl) as SampleCommands by host, _time, Platform
| eval IsBurst=if(DistinctAgentsStopped>=2, "YES", "NO")
| table _time, host, Platform, StopMethod, DistinctAgentsStopped, IsBurst, SampleCommands
| sort - IsBurst, - _timeDetects security-agent and backup-agent stop activity across Windows Sysmon Event ID 1 (process creation) and Linux auditd/syslog process-exec logs. Classifies the stop method (sc stop/disable/delete, net stop, taskkill, PowerShell Stop-Service/Set-Service/Disable-Service, WMIC, systemctl stop/disable/kill, service stop, or a direct SIGKILL) and flags TargetsSecurityAgent/TargetsBackupAgent based on known EDR/AV and backup-agent process/service names. Buckets into 10-minute windows per host so a burst of 2+ distinct agents stopped on the same host (IsBurst=YES) surfaces first as the highest-confidence pre-destructive-payload indicator.
Data Sources
Required Sourcetypes
False Positives & Tuning
- IT automation platforms (SCCM, Ansible, Chef, Puppet) stopping and restarting the EDR/AV agent for a scheduled sensor upgrade or reinstall
- Security vendor self-update/upgrade routines that briefly stop and restart their own service
- Backup software maintenance windows where the backup agent service is intentionally cycled during patching
- Linux configuration management performing a systemctl restart that logs as a transient stop-then-start pair
- Approved decommissioning workflows removing a security or backup agent ahead of host retirement
Other platforms for THREAT-Impact-SecurityAgentServiceTermination
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulated EDR/AV Service Stop via sc.exe (Windows, Lab Only)
Expected signal: Sysmon/DeviceProcessEvents record sc.exe launched with CommandLine containing 'stop TestSentinelAgent' followed by 'config TestSentinelAgent start= disabled'; System log Event ID 7036 (stopped) and 7040 (start type changed) for the target service.
- Test 2Simulated Multi-Agent Stop Burst via PowerShell (Windows, Lab Only)
Expected signal: Two Sysmon Event ID 1 process creation events for powershell.exe with CommandLine containing 'Stop-Service' and the respective decoy service names, seconds apart on the same host.
- Test 3Simulated Linux Security Daemon Stop via systemctl (Lab Only)
Expected signal: auditd exec record and/or Sysmon-for-Linux Event ID 1 for systemctl with CommandLine containing 'stop test-wazuh-agent' and 'mask test-wazuh-agent'; systemd journal entry confirming the unit transitioned to inactive/masked.
- Test 4Simulated Direct SIGKILL of Linux Security Daemon (Lab Only)
Expected signal: auditd exec record for pkill with CommandLine containing '-9' and the decoy process name; kernel log entry for the SIGKILL delivery and process exit.
References (6)
- https://attack.mitre.org/techniques/T1489/
- https://attack.mitre.org/tactics/TA0040/
- https://attack.mitre.org/techniques/T1486/
- https://attack.mitre.org/techniques/T1562/001/
- https://learn.microsoft.com/en-us/windows/win32/services/service-control-manager
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1489/T1489.md
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Impact-SecurityAgentServiceTermination — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.