Elastic Agent Service Terminated
editElastic Agent Service Terminated
editIdentifies the Elastic endpoint agent has stopped and is no longer running on the host. Adversaries may attempt to disable security monitoring tools in an attempt to evade detection or prevention capabilities during an intrusion. This may also indicate an issue with the agent itself and should be addressed to ensure defensive measures are back in a stable state.
Rule type: eql
Rule indices:
- logs-*
Severity: medium
Risk score: 47
Runs every: 5 minutes
Searches indices from: now-9m (Date Math format, see also Additional look-back time
)
Maximum alerts per execution: 100
Tags:
- Elastic
- Host
- Linux
- Windows
- macOS
- Threat Detection
- Defense Evasion
Version: 100 (version history)
Added (Elastic Stack release): 8.3.0
Last modified (Elastic Stack release): 8.5.0
Rule authors: Elastic
Rule license: Elastic License v2
Investigation guide
editRule query
editprocess where /* net, sc or wmic stopping or deleting Elastic Agent on Windows */ (event.type == "start" and process.name : ("net.exe", "sc.exe", "wmic.exe","powershell.exe","taskkill.exe","PsKill.exe","Pro cessHacker.exe") and process.args : ("stopservice","uninstall", "stop", "disabled","Stop-Process","terminate","suspend") and process.args : ("elasticendpoint", "Elastic Agent","elastic- agent","elastic-endpoint")) or /* service or systemctl used to stop Elastic Agent on Linux */ (event.type == "end" and (process.name : ("systemctl", "service") and process.args : "elastic-agent" and process.args : "stop") or /* Unload Elastic Agent extension on MacOS */ (process.name : "kextunload" and process.args : "com.apple.iokit.EndpointSecurity" and event.action : "end"))
Threat mapping
editFramework: MITRE ATT&CKTM
-
Tactic:
- Name: Defense Evasion
- ID: TA0005
- Reference URL: https://attack.mitre.org/tactics/TA0005/
-
Technique:
- Name: Impair Defenses
- ID: T1562
- Reference URL: https://attack.mitre.org/techniques/T1562/
Rule version history
edit- Version 100 (8.5.0 release)
-
-
Updated query, changed from:
process where /* net, sc or wmic stopping or deleting Elastic Agent on Windows */ (event.type == "start" and process.name : ("net.exe", "sc.exe", "wmic.exe","powershell.exe","taskkill.exe","PsKill.exe","Pro cessHacker.exe") and process.args : ("stopservice","uninstall", "stop", "disabled","Stop-Process","terminate","suspend") and process.args : ("elasticendpoint", "Elastic Agent","elastic- agent","elastic-endpoint")) or /* service or systemctl used to stop Elastic Agent on Linux */ (event.type == "end" and (process.name : ("systemctl", "service") and process.args : "elastic-agent" and process.args : "stop") or /* Unload Elastic Agent extension on MacOS */ (process.name : "kextunload" and process.args : "com.apple.iokit.EndpointSecurity" and event.action : "end"))
-
- Version 3 (8.4.0 release)
-
-
Updated query, changed from:
process where /* net, sc or wmic stopping or deleting Elastic Agent on Windows */ (event.type == "start" and process.name : ("net.exe", "sc.exe", "wmic.exe","powershell.exe","taskkill.exe","PsKill.exe","Pro cessHacker.exe") and process.args : ("stopservice","uninstall", "stop", "disabled","Stop-Process","terminate","suspend") and process.args : ("elasticendpoint", "Elastic Agent","elastic- agent","elastic-endpoint")) or /* service or systemctl used to stop Elastic Agent on Linux */ (event.type == "end" and (process.name : ("systemctl","service") and process.args : ("elastic-agent", "stop")) or /* Unload Elastic Agent extension on MacOS */ (process.name : "kextunload" and process.args : "com.apple.iokit.EndpointSecurity" and event.action : "end"))
-