Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Impact-SecurityToolMassServiceStop.
Unlock with Pro - from £29/user/moDetect Mass Stop/Disable of AV, EDR, and Backup Agent Services Preceding Destructive Activity in Microsoft Sentinel
Before deploying an encryptor or wiper, ransomware operators and their affiliates routinely disable or kill every security and backup agent on a host in a tight burst, so that neither the endpoint protection stack nor the backup client can interfere with or later help recover from the destructive payload. This is executed with built-in, signed Windows tooling rather than custom malware: `sc.exe stop <svc>` / `sc.exe config <svc> start= disabled` (stop and permanently disable a service), `net stop <svc>` (the legacy equivalent, still widely scripted), PowerShell `Stop-Service`/`Set-Service -StartupType Disabled` (used when execution is via a PowerShell-based loader or C2 implant), and `taskkill /F /IM <process>.exe` (used to kill the service host process directly when the service control manager itself is protected or tamper-resistant). The distinguishing signal is not any single command — administrators routinely stop one service for maintenance — but the pattern of several distinct AV/EDR and backup-agent service names being targeted by one host/account within a short window, which has essentially no legitimate single-actor explanation outside of a coordinated uninstall or migration. Named targets recur across incident reports: Windows Defender (WinDefend, MsMpSvc, Sense/MDE, SecurityHealthService, WdNisSvc), CrowdStrike Falcon (CSFalconService, CSAgent), SentinelOne (SentinelAgent, SentinelServiceHost), VMware/Carbon Black (CbDefense, CbEvtMgr), Sophos (SAVService, SAVAdminService), Symantec/Broadcom (SepMasterService, ccSvcHst), McAfee/Trellix (McShield, mfemms, mfevtp), Trend Micro (TmCCSF, ntrtscan), BlackBerry Cylance (CylanceSvc), Malwarebytes (MBAMService), and backup agents including Veeam (VeeamBackupSvc, VeeamTransportSvc), Acronis (AcronisAgent), Veritas Backup Exec (BackupExecJobEngine, BackupExecAgentAccelerator), and the native Windows VSS/backup engine (wbengine, SDRSVC). Detection keys on the combination of a stop/disable/kill command syntax against this named-target list, clustered per host within a short window, rather than on any individual binary or service name in isolation.
MITRE ATT&CK
- Tactic
- Impact
KQL Detection Query
let Lookback = 24h;
let StopWindow = 15m;
let SecurityAgentNames = dynamic([
"WinDefend", "MsMpSvc", "Sense", "SecurityHealthService", "WdNisSvc",
"CSFalconService", "CSAgent",
"SentinelAgent", "SentinelServiceHost", "SentinelStaticEngine",
"CbDefense", "CbEvtMgr", "CarbonBlack",
"SAVService", "SAVAdminService", "Sophos",
"SepMasterService", "Symantec", "ccSvcHst",
"McShield", "mfemms", "mfevtp", "Trellix",
"TmCCSF", "ntrtscan", "TrendMicro",
"CylanceSvc", "Cylance",
"MBAMService", "Malwarebytes",
"VeeamBackupSvc", "VeeamTransportSvc", "VeeamDeploymentService",
"AcronisAgent", "BackupExecAgentAccelerator", "BackupExecAgentBrowser", "BackupExecJobEngine", "BackupExecManagementService",
"wbengine", "SDRSVC"
]);
DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where FileName in~ ("sc.exe", "net.exe", "net1.exe", "taskkill.exe", "powershell.exe", "pwsh.exe")
| where (
(FileName =~ "sc.exe" and ProcessCommandLine has_any ("stop", "config"))
or (FileName in~ ("net.exe", "net1.exe") and ProcessCommandLine has "stop")
or (FileName =~ "taskkill.exe" and ProcessCommandLine has_any ("/f", "/im"))
or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("Stop-Service", "Set-Service"))
)
| where ProcessCommandLine has_any (SecurityAgentNames)
| extend StopMethod = case(
FileName =~ "sc.exe" and ProcessCommandLine has "config", "sc_config_disable",
FileName =~ "sc.exe", "sc_stop",
FileName in~ ("net.exe", "net1.exe"), "net_stop",
FileName =~ "taskkill.exe", "taskkill_force",
ProcessCommandLine has "Set-Service", "posh_set_service_disabled",
"posh_stop_service"
)
| extend TargetCategory = case(
ProcessCommandLine has_any ("WinDefend", "MsMpSvc", "Sense", "SecurityHealthService", "WdNisSvc", "CSFalconService", "CSAgent", "SentinelAgent", "SentinelServiceHost", "CbDefense", "CbEvtMgr", "SAVService", "Sophos", "SepMasterService", "Symantec", "McShield", "mfemms", "mfevtp", "TmCCSF", "CylanceSvc", "MBAMService"), "AV_EDR",
ProcessCommandLine has_any ("VeeamBackupSvc", "VeeamTransportSvc", "AcronisAgent", "BackupExec", "wbengine", "SDRSVC"), "Backup",
"Other"
)
| summarize DistinctTargets = dcount(ProcessCommandLine), Methods = make_set(StopMethod), Categories = make_set(TargetCategory), Events = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, AccountName, bin(Timestamp, StopWindow)
| extend MassStop = DistinctTargets >= 3
| extend RiskScore = case(MassStop and Categories has "AV_EDR" and Categories has "Backup", 98, MassStop, 90, 70)
| project FirstSeen, LastSeen, DeviceName, AccountName, DistinctTargets, Methods, Categories, Events, MassStop, RiskScore
| sort by RiskScore desc, LastSeen descDetects sc.exe/net.exe/taskkill.exe/PowerShell commands stopping, disabling, or killing named AV/EDR and backup-agent services, grouped per device/account into 15-minute windows. Flags a MassStop condition when three or more distinct targeted services appear in one window (the near-universal pre-encryption pattern) and scores highest when both a security tool and a backup agent are hit in the same burst, since that combination removes both detection and recovery in one pass.
Data Sources
Required Tables
False Positives & Tuning
- IT administrators or automation platforms (SCCM, Ansible, Chef, Puppet) performing legitimate bulk patch/maintenance cycles that stop several agents before an update and restart them afterward
- Planned migration or uninstall of one security product in favor of another, where the outgoing agent's services are deliberately stopped and disabled across many endpoints in a short window
- Backup software upgrade or reconfiguration windows where the backup vendor's own installer stops its transport/agent services as part of the update process
- Golden-image or VDI refresh pipelines that strip pre-installed AV/EDR agents from a template before recapturing it
- Help desk troubleshooting a malfunctioning AV/EDR client by manually stopping and restarting its service stack on a single workstation
Other platforms for THREAT-Impact-SecurityToolMassServiceStop
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Stop and Disable Windows Defender via sc.exe
Expected signal: Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=sc.exe, two events with CommandLine containing 'stop WinDefend' and 'config WinDefend start= disabled' respectively.
- Test 2Mass Stop of AV/EDR and Backup Services via net stop
Expected signal: Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=net.exe, three events with CommandLine containing 'stop SAVService', 'stop SepMasterService', and 'stop VeeamTransportSvc' respectively, within the same 15-minute window on one host.
- Test 3Kill CrowdStrike Falcon Service Host via taskkill
Expected signal: Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=taskkill.exe, CommandLine contains '/F /IM CSFalconService.exe'.
- Test 4Disable Security Services via PowerShell Stop-Service/Set-Service
Expected signal: Sysmon/DeviceProcessEvents/Security 4688 process creation: FileName=powershell.exe, two events with CommandLine containing 'Stop-Service' and 'Set-Service' respectively, ParentImage referencing powershell.exe/pwsh.exe.
References (7)
- https://attack.mitre.org/techniques/T1489/
- https://attack.mitre.org/tactics/TA0040/
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/sc-config
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/net-stop
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/stop-service
- https://www.cisa.gov/news-events/cybersecurity-advisories
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1489/T1489.md
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Impact-SecurityToolMassServiceStop — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (2)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.