Elastic Agent Service Terminated

  1[metadata]
  2creation_date = "2022/05/23"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies the Elastic endpoint agent has stopped and is no longer running on the host. Adversaries may attempt to
 11disable security monitoring tools in an attempt to evade detection or prevention capabilities during an intrusion. This
 12may also indicate an issue with the agent itself and should be addressed to ensure defensive measures are back in a
 13stable state.
 14"""
 15from = "now-9m"
 16index = ["logs-endpoint.events.process*"]
 17language = "eql"
 18license = "Elastic License v2"
 19name = "Elastic Agent Service Terminated"
 20risk_score = 47
 21rule_id = "b627cd12-dac4-11ec-9582-f661ea17fbcd"
 22severity = "medium"
 23tags = [
 24    "Domain: Endpoint",
 25    "OS: Linux",
 26    "OS: Windows",
 27    "OS: macOS",
 28    "Use Case: Threat Detection",
 29    "Tactic: Defense Evasion",
 30    "Data Source: Elastic Defend",
 31    "Resources: Investigation Guide",
 32    "Noise: Medium",
 33    "Performance: Normal",
 34    "Rule Type: Event Correlation (EQL)",
 35    "Platform: Windows",
 36    "Platform: Linux",
 37    "Platform: macOS",
 38]
 39timestamp_override = "event.ingested"
 40type = "eql"
 41query = '''
 42process where event.type == "start" and
 43(
 44  /* net, sc or wmic stopping or deleting Elastic Agent on Windows */
 45  (
 46    process.name : ("net.exe", "sc.exe", "wmic.exe", "powershell.exe", "taskkill.exe", "PsKill.exe", "ProcessHacker.exe") and
 47    process.args : ("stopservice", "uninstall", "stop", "disabled", "Stop-Process", "terminate", "suspend") and
 48    process.args : ("elasticendpoint", "Elastic Agent", "elastic-agent", "elastic-endpoint")
 49  ) or
 50
 51  /* direct uninstallation of Elastic Agent or Elastic Endpoint on Windows */
 52  (
 53    host.os.type == "windows" and
 54    process.name : ("elastic-agent.exe", "endpoint-security.exe", "elastic-endpoint.exe") and
 55    process.args : "uninstall" and
 56    /* exclude legitimate Elastic-managed reinstall, upgrade, and uninstall subprocesses */
 57    not (
 58      process.parent.code_signature.trusted == true and
 59      process.parent.code_signature.subject_name == "Elasticsearch, Inc." and
 60      (
 61        (
 62          process.name : "elastic-agent.exe" and process.args : "--force" and
 63          process.parent.name : "elastic-agent.exe" and process.parent.args : "install" and
 64          process.parent.args : ("--force", "-f")
 65        ) or
 66        (
 67          process.parent.name : "endpoint-security.exe" and
 68          process.executable : "*\\components\\previous\\elastic-endpoint.exe" and
 69          process.args : "--keepstate" and process.parent.args : "--upgrade"
 70        ) or
 71        (
 72          process.name : "endpoint-security.exe" and process.parent.name : "elastic-agent.exe" and
 73          process.parent.args : "uninstall"
 74        )
 75      )
 76    )
 77  ) or
 78
 79  /* service or systemctl used to stop Elastic Agent on Linux */
 80  (
 81    process.name in ("systemctl", "service", "chkconfig", "update-rc.d") and
 82    process.args : ("elastic-agent", "elastic-agent.service", "ElasticEndpoint") and
 83    process.args : ("stop", "disable", "remove", "off", "kill", "mask") and
 84    not (
 85      process.parent.executable : "/opt/Elastic/Agent/data/elastic-agent-*/components/previous/elastic-endpoint" and
 86      process.parent.args : "uninstall" and
 87      process.parent.args : "--keepstate"
 88    )
 89  ) or
 90  
 91  /* pkill, killall used to stop Elastic Agent or Endpoint on Linux */
 92  (process.name in ("pkill", "killall", "kill") and process.args : ("elastic-agent", "elastic-endpoint")) or
 93
 94  /* Unload Elastic Defend extension on MacOS */
 95  (process.name : "kextunload" and process.args : "com.apple.iokit.EndpointSecurity")
 96)
 97'''
 98
 99setup = """## Setup
100
101This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
102
103Setup instructions: https://ela.st/install-elastic-defend
104"""
105
106note = """## Triage and analysis
107
108> **Disclaimer**:
109> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
110
111### Investigating Elastic Agent Service Terminated
112
113The Elastic Agent is a crucial component for monitoring and securing endpoints across various operating systems. It ensures continuous security oversight by collecting and analyzing data. Adversaries may attempt to disable this agent to evade detection, compromising system defenses. The detection rule identifies suspicious termination activities by monitoring specific processes and commands across Windows, Linux, and macOS, flagging potential defense evasion attempts.
114
115### Possible investigation steps
116
117- Review the event logs to identify the exact process and command used to terminate the Elastic Agent, focusing on the process names and arguments such as "net.exe", "sc.exe", "systemctl", and "pkill" with arguments like "stop", "uninstall", or "disable".
118- Check the timeline of events around the termination to identify any preceding suspicious activities or anomalies that might indicate an adversary's presence or actions.
119- Investigate the user account associated with the process termination to determine if it was authorized or if there are signs of account compromise.
120- Examine the host for any other signs of tampering or compromise, such as unauthorized changes to system configurations or the presence of other malicious processes.
121- Verify the current status of the Elastic Agent on the affected host and attempt to restart it if it is not running, ensuring that security monitoring is restored.
122- Correlate this event with other alerts or logs from the same host or network to identify potential patterns or coordinated attack activities.
123
124### False positive analysis
125
126- Routine maintenance activities may trigger the rule if administrators use commands like systemctl or service to stop the Elastic Agent for updates or configuration changes. To manage this, create exceptions for known maintenance windows or authorized personnel.
127- Automated scripts or deployment tools that temporarily disable the Elastic Agent during software installations or updates can cause false positives. Identify these scripts and whitelist their execution paths or specific arguments.
128- Testing environments where Elastic Agent is frequently started and stopped for development purposes might generate alerts. Exclude these environments by specifying their hostnames or IP addresses in the rule exceptions.
129- Security tools or processes that interact with the Elastic Agent, such as backup solutions or system monitoring tools, might inadvertently stop the service. Review these interactions and adjust the rule to ignore specific process names or arguments associated with these tools.
130- User-initiated actions, such as troubleshooting or system performance optimization, may involve stopping the Elastic Agent. Educate users on the impact of these actions and establish a protocol for notifying the security team when such actions are necessary.
131
132### Response and remediation
133
134- Immediately isolate the affected host from the network to prevent further unauthorized access or potential lateral movement by adversaries.
135- Verify the status of the Elastic Agent on the affected host and attempt to restart the service. If the service fails to restart, investigate potential causes such as corrupted files or missing dependencies.
136- Conduct a thorough review of recent process execution logs on the affected host to identify any unauthorized or suspicious activities that may have led to the termination of the Elastic Agent.
137- If malicious activity is confirmed, perform a comprehensive malware scan and remove any identified threats. Ensure that the host is clean before reconnecting it to the network.
138- Review and update endpoint security configurations to prevent unauthorized termination of security services. This may include implementing stricter access controls or using application whitelisting.
139- Escalate the incident to the security operations team for further analysis and to determine if additional hosts are affected or if there is a broader security incident underway.
140- Document the incident, including all actions taken and findings, to enhance future response efforts and update incident response plans as necessary."""
141
142[[rule.threat]]
143framework = "MITRE ATT&CK"
144
145[[rule.threat.technique]]
146id = "T1562"
147name = "Impair Defenses"
148reference = "https://attack.mitre.org/techniques/T1562/"
149
150[[rule.threat.technique.subtechnique]]
151id = "T1562.001"
152name = "Disable or Modify Tools"
153reference = "https://attack.mitre.org/techniques/T1562/001/"
154
155[rule.threat.tactic]
156id = "TA0005"
157name = "Defense Evasion"
158reference = "https://attack.mitre.org/tactics/TA0005/"
159
160[[rule.threat]]
161framework = "MITRE ATT&CK"
162
163[[rule.threat.technique]]
164id = "T1489"
165name = "Service Stop"
166reference = "https://attack.mitre.org/techniques/T1489/"
167
168[rule.threat.tactic]
169id = "TA0040"
170name = "Impact"
171reference = "https://attack.mitre.org/tactics/TA0040/"