Elastic Agent Service Terminated

 1[metadata]
 2creation_date = "2022/05/23"
 3integration = ["endpoint"]
 4maturity = "production"
 5updated_date = "2024/05/21"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Identifies the Elastic endpoint agent has stopped and is no longer running on the host. Adversaries may attempt to
11disable security monitoring tools in an attempt to evade detection or prevention capabilities during an intrusion. This
12may also indicate an issue with the agent itself and should be addressed to ensure defensive measures are back in a
13stable state.
14"""
15from = "now-9m"
16index = ["logs-endpoint.events.*"]
17language = "eql"
18license = "Elastic License v2"
19name = "Elastic Agent Service Terminated"
20risk_score = 47
21rule_id = "b627cd12-dac4-11ec-9582-f661ea17fbcd"
22setup = """## Setup
23
24If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
25events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
26Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
27`event.ingested` to @timestamp.
28For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
29"""
30severity = "medium"
31tags = [
32    "Domain: Endpoint",
33    "OS: Linux",
34    "OS: Windows",
35    "OS: macOS",
36    "Use Case: Threat Detection",
37    "Tactic: Defense Evasion",
38    "Data Source: Elastic Defend",
39]
40timestamp_override = "event.ingested"
41type = "eql"
42
43query = '''
44process where
45/* net, sc or wmic stopping or deleting Elastic Agent on Windows */
46(event.type == "start" and
47  process.name : ("net.exe", "sc.exe", "wmic.exe","powershell.exe","taskkill.exe","PsKill.exe","ProcessHacker.exe") and
48  process.args : ("stopservice","uninstall", "stop", "disabled","Stop-Process","terminate","suspend") and
49  process.args : ("elasticendpoint", "Elastic Agent","elastic-agent","elastic-endpoint"))
50or
51/* service or systemctl used to stop Elastic Agent on Linux */
52(event.type == "end" and
53  (process.name : ("systemctl", "service") and
54    process.args : "elastic-agent" and
55    process.args : "stop")
56  or
57  /* pkill , killall used to stop Elastic Agent on Linux */
58  ( event.type == "end" and process.name : ("pkill", "killall") and process.args: "elastic-agent")
59  or
60  /* Unload Elastic Agent extension on MacOS */
61  (process.name : "kextunload" and
62    process.args : "com.apple.iokit.EndpointSecurity" and
63    event.action : "end"))
64'''
65
66
67[[rule.threat]]
68framework = "MITRE ATT&CK"
69[[rule.threat.technique]]
70id = "T1562"
71name = "Impair Defenses"
72reference = "https://attack.mitre.org/techniques/T1562/"
73[[rule.threat.technique.subtechnique]]
74id = "T1562.001"
75name = "Disable or Modify Tools"
76reference = "https://attack.mitre.org/techniques/T1562/001/"
77
78
79
80[rule.threat.tactic]
81id = "TA0005"
82name = "Defense Evasion"
83reference = "https://attack.mitre.org/tactics/TA0005/"