Detect Security Agent Service Termination — EDR/AV/Backup-Agent Kill Chain Prelude to Destructive Payload in Sumo Logic CSE
Before deploying ransomware, wipers, or other destructive payloads, adversaries routinely stop or disable the security and backup agents that would otherwise detect or recover from the attack. On Windows this is done with sc.exe stop/config/delete, net stop, taskkill /f, PowerShell Stop-Service/Set-Service/Disable-Service, or WMIC service calls against EDR/AV processes (CrowdStrike Falcon, SentinelOne, Microsoft Defender, Sophos, Carbon Black, Trend Micro, McAfee/Trellix, Symantec, Cortex XDR, Cylance, Malwarebytes) and backup agents (Veeam, Acronis, Commvault, Rubrik, Druva, Cohesity). A stealthier variant bypasses sc.exe entirely and calls the Service Control Manager RPC interface (svcctl, over the \PIPE\svcctl named pipe) directly via OpenSCManagerW/ControlService Win32 API calls from a custom loader, which never shows the service name on a command line and evades command-line-only detection logic. On Linux the equivalent is systemctl stop/disable/mask/kill, service <name> stop, or a direct kill -9/pkill/killall against EDR and monitoring daemons (auditd, falcon-sensor, wazuh-agent, ossec-hids, falco, osqueryd, sophos-spl, cbagentd) and backup daemons (veeamservice, cvd, bpcd, rbs). Because this activity is almost always the immediate precursor to file encryption, mass deletion, or a wiper payload rather than an end in itself, a single stop event on one host is common IT operations noise, but two or more distinct security/backup agents stopped on the same host within a short window is a high-confidence signal that a destructive payload is about to detonate and should trigger immediate isolation ahead of encryption completing.
MITRE ATT&CK
- Tactic
- Impact
Sumo Detection Query
_sourceCategory="windows/sysmon" OR _sourceCategory="linux/auditd" OR _sourceCategory="linux/syslog"
| where EventID = "1" OR _sourceCategory matches "linux*"
| where (Image matches "*\\sc.exe" OR Image matches "*\\net.exe" OR Image matches "*\\net1.exe"
OR Image matches "*\\taskkill.exe" OR Image matches "*\\powershell.exe" OR Image matches "*\\pwsh.exe" OR Image matches "*\\wmic.exe"
OR Image matches "*/systemctl" OR Image matches "*/service" OR Image matches "*/kill" OR Image matches "*/pkill" OR Image matches "*/killall")
| eval CommandLineLower = toLowerCase(CommandLine)
| where CommandLineLower matches "*csfalconservice*" or CommandLineLower matches "*sentinelagent*" or CommandLineLower matches "*windefend*"
or CommandLineLower matches "*mssense*" or CommandLineLower matches "*savservice*" or CommandLineLower matches "*mcshield*"
or CommandLineLower matches "*tmccsf*" or CommandLineLower matches "*cylancesvc*" or CommandLineLower matches "*carbonblack*"
or CommandLineLower matches "*sophosmcs*" or CommandLineLower matches "*wazuh-agent*" or CommandLineLower matches "*auditd*"
or CommandLineLower matches "*veeambackupsvc*" or CommandLineLower matches "*acronisagent*" or CommandLineLower matches "*commvaultservice*"
| eval Platform = if(Image matches "*.exe", "Windows", "Linux")
| timeslice 10m
| stats dc(CommandLineLower) as DistinctAgentsStopped, values(CommandLineLower) as SampleCommands by Computer, _timeslice, Platform
| where DistinctAgentsStopped >= 1
| eval IsBurst = if(DistinctAgentsStopped >= 2, "YES", "NO")
| sort by DistinctAgentsStopped descSumo Logic query over Windows Sysmon and Linux auditd/syslog sources matching stop-tooling process launches referencing a known EDR/AV or backup-agent name. Groups into 10-minute timeslices per host and flags IsBurst=YES once 2+ distinct agents are stopped in the same window, mirroring the primary KQL/SPL burst logic.
Data Sources
Required Tables
False Positives & Tuning
- IT automation and patch-management tools cycling the agent during scheduled maintenance
- Security vendor self-update routines that briefly stop and restart their own service
- Backup software maintenance windows that intentionally cycle the backup agent
Other platforms for THREAT-Impact-SecurityAgentServiceTermination
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulated EDR/AV Service Stop via sc.exe (Windows, Lab Only)
Expected signal: Sysmon/DeviceProcessEvents record sc.exe launched with CommandLine containing 'stop TestSentinelAgent' followed by 'config TestSentinelAgent start= disabled'; System log Event ID 7036 (stopped) and 7040 (start type changed) for the target service.
- Test 2Simulated Multi-Agent Stop Burst via PowerShell (Windows, Lab Only)
Expected signal: Two Sysmon Event ID 1 process creation events for powershell.exe with CommandLine containing 'Stop-Service' and the respective decoy service names, seconds apart on the same host.
- Test 3Simulated Linux Security Daemon Stop via systemctl (Lab Only)
Expected signal: auditd exec record and/or Sysmon-for-Linux Event ID 1 for systemctl with CommandLine containing 'stop test-wazuh-agent' and 'mask test-wazuh-agent'; systemd journal entry confirming the unit transitioned to inactive/masked.
- Test 4Simulated Direct SIGKILL of Linux Security Daemon (Lab Only)
Expected signal: auditd exec record for pkill with CommandLine containing '-9' and the decoy process name; kernel log entry for the SIGKILL delivery and process exit.
References (6)
- https://attack.mitre.org/techniques/T1489/
- https://attack.mitre.org/tactics/TA0040/
- https://attack.mitre.org/techniques/T1486/
- https://attack.mitre.org/techniques/T1562/001/
- https://learn.microsoft.com/en-us/windows/win32/services/service-control-manager
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1489/T1489.md
Response Playbook
Triage
- Identify every distinct security or backup agent stopped on the host and the exact timestamps — two or more distinct agents stopped within a 10-minute window is the primary escalation trigger for this detection
- Check whether the stop command originated from an approved change ticket, patch cycle, or known agent-upgrade process (compare InitiatingProcessParentFileName/InitiatingProcessCommandLine against your RMM/SCCM/Ansible service accounts)
- Immediately check the host for signs that a destructive payload has already begun executing — mass file rename/creation with new extensions, ransom note files, or unusual disk I/O — since agent termination is almost always the last step before detonation, not the goal itself
- Determine the account and logon session used to run the stop command (interactive console, RDP, PsExec/WMI remote execution, or a scheduled task) to establish whether this is attacker-controlled or legitimate remote administration
- Check other hosts for the same stop pattern in the same time window — mass EDR/AV termination is frequently scripted and pushed to many hosts near-simultaneously via GPO, PsExec, or a C2 implant's lateral movement module
- If the SCM RPC (svcctl named pipe) hunting signal fired instead of a CLI tool, treat it as higher confidence than a CLI-based stop — direct Win32 API service control is specifically used to evade command-line-based detections and is rarely legitimate
Containment
- Isolate the affected host from the network immediately if a burst (2+ distinct agents stopped) is confirmed and not tied to a known change window — do not wait for encryption/wiper indicators to appear before acting
- Re-enable and restart the stopped security agent(s) from an out-of-band management console (not from the potentially compromised host itself) and verify the agent reports healthy telemetry again
- Disable or rotate the credentials/account used to execute the stop commands, and revoke any active remote-execution sessions (PsExec, WMI, WinRM, SSH) associated with that account
- If multiple hosts show the same pattern in the same window, treat it as an active mass-deployment event and isolate the full affected host set, not just the first one identified
- Preserve the current disk state (snapshot or forensic image) on the affected host before any remediation or reboot, in case a destructive payload has already begun writing to disk
Evidence Collection
- Full process command-line history (DeviceProcessEvents / Sysmon Event ID 1) for the affected host across the incident window, including parent process chains back to the initial access vector
- EDR/AV agent status and uptime history from the vendor console showing exactly when telemetry stopped and, if applicable, resumed
- Any Sysmon Event ID 17/18 (PipeCreated/PipeConnected) records referencing \svcctl to confirm or rule out raw SCM API abuse rather than CLI-based stops
- Authentication logs (4624/4625/4648) and remote-execution artifacts (PsExec service creation events, WMI activity, WinRM session logs) covering the account that issued the stop commands
- A timeline of any subsequent file system activity (mass rename, mass delete, new file extensions) to confirm whether a destructive payload executed after the agent was disabled
Escalation Criteria
- !Two or more distinct security or backup agents stopped on the same host within a 10-minute window with no matching change ticket
- !The same stop pattern observed across more than one host within the same operational window, indicating a scripted mass-deployment rather than an isolated action
- !Any evidence of file encryption, mass deletion, or a ransom note appearing on the host after the agent stop, confirming the destructive payload has begun
- !A confirmed SCM RPC (svcctl pipe) based stop from a process with no legitimate administrative purpose, indicating deliberate evasion of command-line detection
- !Stop activity correlated with credentials or source hosts already flagged in a prior or concurrent incident involving initial access or lateral movement
Investigation Guide
Related Techniques
Forensic Artifacts
- >
DeviceProcessEvents / Sysmon Event ID 1: full command line and parent process chain for the stop command - >
Windows Event ID 7036 (Service Control Manager — service entered stopped state) and 7040 (start type changed) from the System log, which record independently of the tool used to issue the stop - >
Sysmon Event ID 17/18 (PipeCreated/PipeConnected) referencing \svcctl, present when a process communicates with the Service Control Manager via RPC directly rather than through sc.exe - >
Linux systemd journal (journalctl -u <unit>) and auditd exec records for systemctl/service/kill/pkill invocations, including the calling UID and TTY/session - >
EDR/AV vendor console agent health and tamper-event history, which often independently logs an unexpected stop or tamper attempt even if local host logs are cleared - >
PsExec/WMI/WinRM remote-execution artifacts if the stop command was issued remotely rather than from an interactive console session
Tuning Guidance
Build an allowlist of the service accounts and RMM/patch-management tools (SCCM, Intune, Ansible, Chef, Puppet) that are authorized to stop and restart EDR/AV or backup agents during maintenance windows, and exclude their known process lineage before alerting — this single step removes the majority of noise since legitimate agent upgrades are the most common false positive. Treat the IsBurst / DistinctAgentsStopped >= 2 condition as the primary alerting threshold; a single agent stop alone is too common to page on directly but should still be logged for correlation. Weight the SCM RPC (svcctl pipe) hunting signal higher than any CLI-based match when it fires, since legitimate administration overwhelmingly uses sc.exe, PowerShell, or the Services console rather than raw API calls — a match there with no corresponding CLI evidence is a strong indicator of deliberate detection evasion. For Linux, exclude systemd unit restart cycles (a stop immediately followed by a start of the same unit within seconds) which typically indicate a config reload rather than an attack, and focus on stop/disable/mask/kill actions with no corresponding restart.
Hunting Queries
Baseline hunt for processes accessing the Service Control Manager's RPC interface via the \svcctl named pipe without going through sc.exe, PowerShell, or the Services MMC snap-in. This catches EDR-killer tooling that calls OpenSCManagerW/ControlService directly to stop protected security services without ever putting the target service name on a command line, which defeats CLI-only detection logic. Requires Sysmon configured to log Event ID 17/18 (pipe events), which many default Sysmon configs exclude for noise reasons — verify coverage before relying on this hunt.
// Hunt: SCM RPC (svcctl named pipe) access from a process other than services.exe or known admin tools — indicates raw Win32 API service control bypassing sc.exe
Event
| where TimeGenerated > ago(14d)
| where Source == "Microsoft-Windows-Sysmon"
| where EventID in (17, 18)
| where EventData has "svcctl"
| extend ImagePath = tostring(extract(@'<Data Name="Image">([^<]+)</Data>', 1, EventData))
| where ImagePath !has "services.exe" and ImagePath !has "mmc.exe" and ImagePath !has "sc.exe" and ImagePath !has "WmiPrvSE.exe"
| summarize Occurrences = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Computer, ImagePath
| order by Occurrences descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=17 OR EventCode=18) PipeName="*svcctl*"
| where NOT match(Image, "(?i)(services\.exe|mmc\.exe|sc\.exe|wmiprvse\.exe)")
| stats count as Occurrences, earliest(_time) as FirstSeen, latest(_time) as LastSeen by host, Image
| sort - OccurrencesWider 30-day, 24-hour-window hunt (versus the primary detection's tight 10-minute burst) to catch slower, more deliberate agent-termination campaigns where an operator disables protections over hours rather than in a single automated script, which the tight burst window would miss.
// Hunt: hosts with 2+ distinct security/backup agents stopped within any 24h window over the last 30 days (wider net than the primary 10-minute burst detection)
DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName in~ ("sc.exe", "net.exe", "net1.exe", "taskkill.exe", "powershell.exe", "pwsh.exe", "wmic.exe", "systemctl", "service", "kill", "pkill", "killall")
| where ProcessCommandLine has_any ("CSFalconService", "SentinelAgent", "WinDefend", "MsSense", "SAVService", "McShield", "TmCCSF", "CylanceSvc", "CarbonBlack", "SophosMCS", "wazuh-agent", "auditd", "VeeamBackupSvc", "AcronisAgent", "CommvaultService")
| summarize DistinctAgents = dcount(ProcessCommandLine), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName
| where DistinctAgents >= 2
| order by DistinctAgents descindex=wineventlog OR index=linux sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(CommandLine="*CSFalconService*" OR CommandLine="*SentinelAgent*" OR CommandLine="*WinDefend*" OR CommandLine="*MsSense*" OR CommandLine="*SAVService*" OR CommandLine="*McShield*" OR CommandLine="*TmCCSF*" OR CommandLine="*CylanceSvc*" OR CommandLine="*CarbonBlack*" OR CommandLine="*SophosMCS*" OR CommandLine="*wazuh-agent*" OR CommandLine="*auditd*" OR CommandLine="*VeeamBackupSvc*" OR CommandLine="*AcronisAgent*" OR CommandLine="*CommvaultService*")
| stats dc(CommandLine) as DistinctAgents, earliest(_time) as FirstSeen, latest(_time) as LastSeen by host
| where DistinctAgents >= 2
| sort - DistinctAgentsAtomic Red Team Tests
Stops and disables a decoy service named to mimic a security agent, replicating the sc.exe stop/config sequence used to disable EDR/AV before a destructive payload runs. Use a disposable test service, never a production security agent.
Command
sc.exe stop TestSentinelAgent && sc.exe config TestSentinelAgent start= disabledCleanup
sc.exe config TestSentinelAgent start= auto && sc.exe start TestSentinelAgentExpected Telemetry
Sysmon/DeviceProcessEvents record sc.exe launched with CommandLine containing 'stop TestSentinelAgent' followed by 'config TestSentinelAgent start= disabled'; System log Event ID 7036 (stopped) and 7040 (start type changed) for the target service.
Expected Detection
KQL/SPL detection matches StopMethod='sc stop' and 'sc disable' with TargetsSecurityAgent=true if the decoy service name is added to the SecurityAgentNames list for the test, or fires generically as a CLI-based stop otherwise.
Stops two decoy services in rapid succession using PowerShell Stop-Service, replicating the burst pattern (2+ distinct agents stopped within a short window) that the primary detection escalates on.
Command
Stop-Service -Name TestSentinelAgent -Force; Stop-Service -Name TestVeeamBackupSvc -ForceCleanup
Start-Service -Name TestSentinelAgent; Start-Service -Name TestVeeamBackupSvcExpected Telemetry
Two Sysmon Event ID 1 process creation events for powershell.exe with CommandLine containing 'Stop-Service' and the respective decoy service names, seconds apart on the same host.
Expected Detection
KQL/SPL burst logic sets IsBurst=YES/true (DistinctAgentsStopped >= 2 within the 10-minute bucket) since both a security-agent and a backup-agent decoy were stopped in the same window.
Stops and masks a decoy systemd unit named to mimic an EDR daemon, replicating the systemctl stop/mask sequence attackers use on Linux to permanently disable monitoring before a wiper or ransomware payload runs.
Command
sudo systemctl stop test-wazuh-agent && sudo systemctl mask test-wazuh-agentCleanup
sudo systemctl unmask test-wazuh-agent && sudo systemctl start test-wazuh-agentExpected Telemetry
auditd exec record and/or Sysmon-for-Linux Event ID 1 for systemctl with CommandLine containing 'stop test-wazuh-agent' and 'mask test-wazuh-agent'; systemd journal entry confirming the unit transitioned to inactive/masked.
Expected Detection
KQL/SPL detection matches StopMethod='systemctl stop/disable/kill' with Platform='Linux' and TargetsSecurityAgent=true if the decoy unit name is added to the SecurityAgentNames list for the test.
Sends SIGKILL directly to a decoy daemon process, replicating the kill -9/pkill fallback attackers use when a daemon is protected against a graceful systemctl stop or when speed matters more than a clean shutdown.
Command
pkill -9 -f test-falcon-sensor-decoyCleanup
nohup /usr/local/bin/test-falcon-sensor-decoy >/dev/null 2>&1 &Expected Telemetry
auditd exec record for pkill with CommandLine containing '-9' and the decoy process name; kernel log entry for the SIGKILL delivery and process exit.
Expected Detection
KQL/SPL detection matches StopMethod='SIGKILL daemon' with Platform='Linux'; escalates to IsBurst if combined with a second decoy agent stop within the same 10-minute window.
Related Detections
Tactic Hub
Detection Variants (2)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.