Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Impact-SecurityAgentServiceTermination.
Upgrade to ProDetect Security Agent Service Termination — EDR/AV/Backup-Agent Kill Chain Prelude to Destructive Payload in Sumo Logic CSE
Before deploying ransomware, wipers, or other destructive payloads, adversaries routinely stop or disable the security and backup agents that would otherwise detect or recover from the attack. On Windows this is done with sc.exe stop/config/delete, net stop, taskkill /f, PowerShell Stop-Service/Set-Service/Disable-Service, or WMIC service calls against EDR/AV processes (CrowdStrike Falcon, SentinelOne, Microsoft Defender, Sophos, Carbon Black, Trend Micro, McAfee/Trellix, Symantec, Cortex XDR, Cylance, Malwarebytes) and backup agents (Veeam, Acronis, Commvault, Rubrik, Druva, Cohesity). A stealthier variant bypasses sc.exe entirely and calls the Service Control Manager RPC interface (svcctl, over the \PIPE\svcctl named pipe) directly via OpenSCManagerW/ControlService Win32 API calls from a custom loader, which never shows the service name on a command line and evades command-line-only detection logic. On Linux the equivalent is systemctl stop/disable/mask/kill, service <name> stop, or a direct kill -9/pkill/killall against EDR and monitoring daemons (auditd, falcon-sensor, wazuh-agent, ossec-hids, falco, osqueryd, sophos-spl, cbagentd) and backup daemons (veeamservice, cvd, bpcd, rbs). Because this activity is almost always the immediate precursor to file encryption, mass deletion, or a wiper payload rather than an end in itself, a single stop event on one host is common IT operations noise, but two or more distinct security/backup agents stopped on the same host within a short window is a high-confidence signal that a destructive payload is about to detonate and should trigger immediate isolation ahead of encryption completing.
MITRE ATT&CK
- Tactic
- Impact
Sumo Detection Query
_sourceCategory="windows/sysmon" OR _sourceCategory="linux/auditd" OR _sourceCategory="linux/syslog"
| where EventID = "1" OR _sourceCategory matches "linux*"
| where (Image matches "*\\sc.exe" OR Image matches "*\\net.exe" OR Image matches "*\\net1.exe"
OR Image matches "*\\taskkill.exe" OR Image matches "*\\powershell.exe" OR Image matches "*\\pwsh.exe" OR Image matches "*\\wmic.exe"
OR Image matches "*/systemctl" OR Image matches "*/service" OR Image matches "*/kill" OR Image matches "*/pkill" OR Image matches "*/killall")
| eval CommandLineLower = toLowerCase(CommandLine)
| where CommandLineLower matches "*csfalconservice*" or CommandLineLower matches "*sentinelagent*" or CommandLineLower matches "*windefend*"
or CommandLineLower matches "*mssense*" or CommandLineLower matches "*savservice*" or CommandLineLower matches "*mcshield*"
or CommandLineLower matches "*tmccsf*" or CommandLineLower matches "*cylancesvc*" or CommandLineLower matches "*carbonblack*"
or CommandLineLower matches "*sophosmcs*" or CommandLineLower matches "*wazuh-agent*" or CommandLineLower matches "*auditd*"
or CommandLineLower matches "*veeambackupsvc*" or CommandLineLower matches "*acronisagent*" or CommandLineLower matches "*commvaultservice*"
| eval Platform = if(Image matches "*.exe", "Windows", "Linux")
| timeslice 10m
| stats dc(CommandLineLower) as DistinctAgentsStopped, values(CommandLineLower) as SampleCommands by Computer, _timeslice, Platform
| where DistinctAgentsStopped >= 1
| eval IsBurst = if(DistinctAgentsStopped >= 2, "YES", "NO")
| sort by DistinctAgentsStopped descSumo Logic query over Windows Sysmon and Linux auditd/syslog sources matching stop-tooling process launches referencing a known EDR/AV or backup-agent name. Groups into 10-minute timeslices per host and flags IsBurst=YES once 2+ distinct agents are stopped in the same window, mirroring the primary KQL/SPL burst logic.
Data Sources
Required Tables
False Positives & Tuning
- IT automation and patch-management tools cycling the agent during scheduled maintenance
- Security vendor self-update routines that briefly stop and restart their own service
- Backup software maintenance windows that intentionally cycle the backup agent
Other platforms for THREAT-Impact-SecurityAgentServiceTermination
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulated EDR/AV Service Stop via sc.exe (Windows, Lab Only)
Expected signal: Sysmon/DeviceProcessEvents record sc.exe launched with CommandLine containing 'stop TestSentinelAgent' followed by 'config TestSentinelAgent start= disabled'; System log Event ID 7036 (stopped) and 7040 (start type changed) for the target service.
- Test 2Simulated Multi-Agent Stop Burst via PowerShell (Windows, Lab Only)
Expected signal: Two Sysmon Event ID 1 process creation events for powershell.exe with CommandLine containing 'Stop-Service' and the respective decoy service names, seconds apart on the same host.
- Test 3Simulated Linux Security Daemon Stop via systemctl (Lab Only)
Expected signal: auditd exec record and/or Sysmon-for-Linux Event ID 1 for systemctl with CommandLine containing 'stop test-wazuh-agent' and 'mask test-wazuh-agent'; systemd journal entry confirming the unit transitioned to inactive/masked.
- Test 4Simulated Direct SIGKILL of Linux Security Daemon (Lab Only)
Expected signal: auditd exec record for pkill with CommandLine containing '-9' and the decoy process name; kernel log entry for the SIGKILL delivery and process exit.
References (6)
- https://attack.mitre.org/techniques/T1489/
- https://attack.mitre.org/tactics/TA0040/
- https://attack.mitre.org/techniques/T1486/
- https://attack.mitre.org/techniques/T1562/001/
- https://learn.microsoft.com/en-us/windows/win32/services/service-control-manager
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1489/T1489.md
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Impact-SecurityAgentServiceTermination — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.