Detect Mass Stop/Disable of AV, EDR, and Backup Agent Services Preceding Destructive Activity in CrowdStrike LogScale
Before deploying an encryptor or wiper, ransomware operators and their affiliates routinely disable or kill every security and backup agent on a host in a tight burst, so that neither the endpoint protection stack nor the backup client can interfere with or later help recover from the destructive payload. This is executed with built-in, signed Windows tooling rather than custom malware: `sc.exe stop <svc>` / `sc.exe config <svc> start= disabled` (stop and permanently disable a service), `net stop <svc>` (the legacy equivalent, still widely scripted), PowerShell `Stop-Service`/`Set-Service -StartupType Disabled` (used when execution is via a PowerShell-based loader or C2 implant), and `taskkill /F /IM <process>.exe` (used to kill the service host process directly when the service control manager itself is protected or tamper-resistant). The distinguishing signal is not any single command — administrators routinely stop one service for maintenance — but the pattern of several distinct AV/EDR and backup-agent service names being targeted by one host/account within a short window, which has essentially no legitimate single-actor explanation outside of a coordinated uninstall or migration. Named targets recur across incident reports: Windows Defender (WinDefend, MsMpSvc, Sense/MDE, SecurityHealthService, WdNisSvc), CrowdStrike Falcon (CSFalconService, CSAgent), SentinelOne (SentinelAgent, SentinelServiceHost), VMware/Carbon Black (CbDefense, CbEvtMgr), Sophos (SAVService, SAVAdminService), Symantec/Broadcom (SepMasterService, ccSvcHst), McAfee/Trellix (McShield, mfemms, mfevtp), Trend Micro (TmCCSF, ntrtscan), BlackBerry Cylance (CylanceSvc), Malwarebytes (MBAMService), and backup agents including Veeam (VeeamBackupSvc, VeeamTransportSvc), Acronis (AcronisAgent), Veritas Backup Exec (BackupExecJobEngine, BackupExecAgentAccelerator), and the native Windows VSS/backup engine (wbengine, SDRSVC). Detection keys on the combination of a stop/disable/kill command syntax against this named-target list, clustered per host within a short window, rather than on any individual binary or service name in isolation.
MITRE ATT&CK
- Tactic
- Impact
LogScale Detection Query
#event_simpleName=ProcessRollup2
(
(FileName=/^sc\.exe$/i CommandLine=/(stop|config)/i) OR
(FileName=/^net1?\.exe$/i CommandLine=/stop/i) OR
(FileName=/^taskkill\.exe$/i CommandLine=/(\/f|\/im)/i) OR
(FileName=/^powershell\.exe$/i CommandLine=/(Stop-Service|Set-Service)/i)
)
CommandLine=/(WinDefend|MsMpSvc|Sense|CSFalconService|SentinelAgent|CbDefense|SAVService|SepMasterService|McShield|TmCCSF|CylanceSvc|VeeamBackupSvc|AcronisAgent|BackupExec|wbengine|SDRSVC)/i
| StopMethod := case([
FileName=/^sc\.exe$/i, "sc_stop_or_config";
FileName=/^net1?\.exe$/i, "net_stop";
FileName=/^taskkill\.exe$/i, "taskkill_force";
true(), "posh_stop_or_set_service"
])
| groupBy([ComputerName, UserName], function=[count(as=Events), collect(CommandLine, limit=20, as=Targets)])
| sort(Events, order=desc)CrowdStrike LogScale query over ProcessRollup2 events for sc.exe/net.exe/taskkill.exe/PowerShell commands targeting named AV/EDR and backup-agent services. Recommend a companion scheduled search requiring 3+ distinct Targets values within a 15-minute window to reproduce the MassStop burst scoring.
Data Sources
Required Tables
False Positives & Tuning
- Bulk patch/maintenance automation stopping several agents before an update
- Planned migration or uninstall of one security product in favor of another
- Backup software upgrade windows stopping the vendor's own agent services
- Golden-image pipelines stripping pre-installed AV/EDR agents from a template
Other platforms for THREAT-Impact-SecurityToolMassServiceStop
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Stop and Disable Windows Defender via sc.exe
Expected signal: Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=sc.exe, two events with CommandLine containing 'stop WinDefend' and 'config WinDefend start= disabled' respectively.
- Test 2Mass Stop of AV/EDR and Backup Services via net stop
Expected signal: Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=net.exe, three events with CommandLine containing 'stop SAVService', 'stop SepMasterService', and 'stop VeeamTransportSvc' respectively, within the same 15-minute window on one host.
- Test 3Kill CrowdStrike Falcon Service Host via taskkill
Expected signal: Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=taskkill.exe, CommandLine contains '/F /IM CSFalconService.exe'.
- Test 4Disable Security Services via PowerShell Stop-Service/Set-Service
Expected signal: Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=powershell.exe, two events with CommandLine containing 'Stop-Service' and 'Set-Service' respectively, ParentImage referencing powershell.exe/pwsh.exe.
References (7)
- https://attack.mitre.org/techniques/T1489/
- https://attack.mitre.org/tactics/TA0040/
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/sc-config
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/net-stop
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/stop-service
- https://www.cisa.gov/news-events/cybersecurity-advisories
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1489/T1489.md
Response Playbook
Triage
- Enumerate every distinct service/process targeted in the window and split into categories (AV/EDR vs. backup agent vs. other) — a burst that hits both an AV/EDR product and a backup agent on the same host has essentially no legitimate single-actor explanation and should be treated as an active incident, not a routine alert
- Check the initiating process and parent process chain: was this run interactively by a logged-on administrator, or spawned by a script, scheduled task, PsExec/WMI remote execution, or an RMM/C2 agent — the latter is far more consistent with an attacker executing a pre-encryption disablement script
- Determine whether the same account or a coordinated set of accounts triggered this pattern across multiple hosts in the same time window — mass service disablement is frequently pushed environment-wide via GPO, PsExec, or an RMM tool immediately before mass encryption
- Verify against the change/maintenance calendar and any known agent migration or uninstall project — if no scheduled maintenance or migration explains the timing, escalate immediately
- Check for concurrent or immediately-following indicators of the encryption/destruction stage itself: mass file rename/write activity, a new unsigned/unknown binary executing across multiple hosts, shadow-copy or backup-catalog deletion, or bcdedit recovery tampering — any of these materially raises urgency from 'investigate' to 'active incident'
Containment
- Isolate the affected host(s) from the network immediately (EDR network isolation or physical disconnection) before the same session can proceed to mass encryption or lateral movement — attempt isolation via a channel other than the just-disabled agent if it is still reachable, or fall back to network-level containment (switch port shutdown, firewall block) if the agent itself was killed
- Disable or force-expire the credentials of the account that executed the commands, and revoke any active sessions (RDP, PsExec admin$ shares, WMI, RMM) associated with it
- If multiple hosts show the pattern, assume an environment-wide event is in progress: pre-emptively isolate high-value servers (domain controllers, file servers, backup infrastructure, hypervisors) that have not yet shown the indicator before the attacker reaches them
- Verify the integrity and isolation of offsite/immutable/air-gapped backups immediately — do not wait for full scoping, since the on-host backup agent being killed is frequently paired with an attempt to reach and purge reachable network backup infrastructure
Evidence Collection
- Full process-creation record (command line, parent process, initiating user, logon session, PID/GUID) for every matched sc.exe/net.exe/taskkill.exe/PowerShell event, plus the resulting Service Control Manager event log entries (System log Event ID 7034/7035/7036/7040)
- Preceding 24-48 hours of process, logon, and remote-execution telemetry for the source host and account to reconstruct how the attacker obtained the privileges needed to stop protected security services
- Any dropped batch files, PowerShell scripts, or scheduled tasks/GPO startup scripts that reference these commands, since they frequently also contain the ransomware payload's staging or execution logic
- EDR/AV console logs confirming when and how each agent went offline (graceful service stop vs. tamper-protection bypass vs. uninstall) to distinguish an attacker technique from a genuine local admin action
Escalation Criteria
- !Three or more distinct AV/EDR or backup-agent services are stopped/disabled on the same host within the 15-minute window — this combination has essentially no legitimate single-actor use case outside a documented migration
- !Both an AV/EDR product and a backup agent are hit in the same burst, or the pattern is observed across more than one host in the same time window, indicating scripted or centrally-pushed execution
- !The account or process chain shows signs of compromise (unfamiliar RMM/remote-execution tool, off-hours execution, recently elevated privileges)
- !Any concurrent indicator of active encryption, shadow-copy/backup-catalog deletion, or mass file modification is observed on the same or related hosts
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Process-creation events (Sysmon Event ID 1, Security Event ID 4688, DeviceProcessEvents) for sc.exe, net.exe/net1.exe, taskkill.exe, and powershell.exe with the matching service-stop command-line arguments - >
Windows System Event Log entries from the Service Control Manager reflecting each service transition (Event ID 7034 unexpected termination, 7035 stop/start control sent, 7036 service entered stopped state, 7040 start type changed) - >
Prefetch and Amcache entries confirming execution of sc.exe/taskkill.exe/net.exe on the host, useful when process-creation logging was not enabled at the time - >
EDR/AV vendor tamper-protection or agent-health telemetry showing the exact timestamp and method the agent went offline - >
Any dropped batch/PowerShell scripts, scheduled tasks, or GPO startup scripts referencing these commands, which frequently also contain the ransomware payload's staging or execution logic
Tuning Guidance
Build an allowlist of known deployment/automation service accounts and the specific change windows for planned AV/EDR migrations or backup-agent upgrades, and suppress or down-rank alerts from that allowlist by account/host and time window rather than by command — the command syntax itself is identical between legitimate maintenance and attacker disablement. Keep the highest-severity tier reserved for the multi-category combination (an AV/EDR service and a backup-agent service both stopped on the same host within the 15-minute window), since a single service stop in isolation has meaningfully more legitimate use than the full combination. Cross-correlate with THREAT-Impact-VSSShadowCopyDeletion and with mass-encryption/file-rename detections, since ransomware operators rarely execute security-tool disablement in isolation from the rest of the pre-encryption kill chain.
Hunting Queries
30-day baseline hunt across all AV/EDR/backup-agent stop commands to establish which accounts/hosts run them routinely (deployment automation, migration projects) versus which show a first-time or rare multi-service burst — a rare account or workstation-class device stopping three or more distinct security/backup services is significantly higher-suspicion than a known deployment-automation identity.
// Hunt: 30-day baseline of all AV/EDR/backup-agent stop commands, to distinguish routine maintenance/migration from anomalous first-time bursts
DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName in~ ("sc.exe", "net.exe", "net1.exe", "taskkill.exe", "powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("WinDefend", "MsMpSvc", "Sense", "CSFalconService", "SentinelAgent", "CbDefense", "SAVService", "SepMasterService", "McShield", "TmCCSF", "CylanceSvc", "VeeamBackupSvc", "AcronisAgent", "BackupExec", "wbengine", "SDRSVC")
| summarize Executions = count(), DistinctServices = dcount(ProcessCommandLine), Hosts = dcount(DeviceName), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by AccountName
| where DistinctServices >= 3
| sort by DistinctServices descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
Image IN ("*\\sc.exe", "*\\net.exe", "*\\net1.exe", "*\\taskkill.exe", "*\\powershell.exe")
CommandLine IN ("*WinDefend*", "*MsMpSvc*", "*Sense*", "*CSFalconService*", "*SentinelAgent*", "*CbDefense*", "*SAVService*", "*SepMasterService*", "*McShield*", "*TmCCSF*", "*CylanceSvc*", "*VeeamBackupSvc*", "*AcronisAgent*", "*BackupExec*", "*wbengine*", "*SDRSVC*")
| stats count as Executions, dc(CommandLine) as DistinctServices, dc(host) as Hosts, earliest(_time) as FirstSeen, latest(_time) as LastSeen by User
| where DistinctServices>=3
| sort - DistinctServicesAtomic Red Team Tests
Stops and permanently disables the Windows Defender service using sc.exe, the canonical LOLBin technique for taking AV offline before deploying a payload. Run only in an isolated test VM with tamper protection disabled for testing purposes.
Command
sc.exe stop WinDefend && sc.exe config WinDefend start= disabledCleanup
sc.exe config WinDefend start= auto && sc.exe start WinDefendExpected Telemetry
Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=sc.exe, two events with CommandLine containing 'stop WinDefend' and 'config WinDefend start= disabled' respectively.
Expected Detection
Alert contributes StopMethod=sc_stop and sc_config_disable, TargetCategory=AV_EDR toward the DistinctTargets count in the 15-minute window.
Uses net.exe to stop three distinct security and backup agent services in quick succession, reproducing the multi-service burst pattern that distinguishes attacker disablement from routine single-service maintenance. Run only in a disposable test VM with test-only service stand-ins.
Command
net stop SAVService && net stop SepMasterService && net stop VeeamTransportSvcCleanup
net start SAVService && net start SepMasterService && net start VeeamTransportSvcExpected Telemetry
Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=net.exe, three events with CommandLine containing 'stop SAVService', 'stop SepMasterService', and 'stop VeeamTransportSvc' respectively, within the same 15-minute window on one host.
Expected Detection
Alert fires with MassStop=true, DistinctTargets=3, Categories containing both AV_EDR and Backup, RiskScore=98.
Force-kills the CrowdStrike Falcon service process directly with taskkill, the technique used when the service control manager itself resists a graceful sc/net stop due to tamper protection. Run only in a disposable test VM with a non-production agent.
Command
taskkill /F /IM CSFalconService.exeCleanup
Restart the CrowdStrike Falcon service via the Services console or 'sc start CSFalconService' (or simply revert the disposable test VM snapshot).Expected Telemetry
Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=taskkill.exe, CommandLine contains '/F /IM CSFalconService.exe'.
Expected Detection
Alert contributes StopMethod=taskkill_force, TargetCategory=AV_EDR toward the DistinctTargets count in the 15-minute window.
Uses PowerShell's Stop-Service and Set-Service cmdlets to stop and permanently disable a security agent, the variant used when execution is via a PowerShell-based loader or remote-execution channel rather than a raw console command. Run only in a disposable test VM.
Command
Stop-Service -Name SentinelAgent -Force; Set-Service -Name SentinelAgent -StartupType DisabledCleanup
Set-Service -Name SentinelAgent -StartupType Automatic; Start-Service -Name SentinelAgentExpected Telemetry
Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=powershell.exe, two events with CommandLine containing 'Stop-Service' and 'Set-Service' respectively, ParentImage referencing powershell.exe/pwsh.exe.
Expected Detection
Alert contributes StopMethod=posh_stop_service and posh_set_service_disabled, TargetCategory=AV_EDR toward the DistinctTargets count in the 15-minute window.
Related Detections
Tactic Hub
Detection Variants (2)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.