AN1369
Analytic 1369
Windows
Detection of adversary behavior that disables or modifies security tools, including killing AV/EDR processes, stopping services, altering Sysmon registry keys, or tampering with exclusion lists. Defenders observe process/service termination, registry modification, and abnormal absence of expected telemetry.
WinEventLog:System
EventCode=7045
WinEventLog:Sysmon
EventCode=5
WinEventLog:Sysmon
EventCode=13, 14
[ProcessNameExclusions]
List of expected administrative tools/processes to prevent false positives.
[TimeWindow]
Defines correlation window linking process termination, registry edits, and service stoppage.
[ServiceNames]
Customizable list of security service names per enterprise deployment.
AN1370
Analytic 1370
Linux
Detects kill/systemctl/service commands against EDR, auditd, falco, osquery, rsyslog, journald, or agent processes; configuration edits disabling startup; module unload attempts; abrupt cessation of logs after privileged shell execution.
auditd:SYSCALL
execve: systemctl stop, service stop, or kill -9 on security daemons (e.g., falcon-sensor, auditd)
auditd:CONFIG_CHANGE
delete: Modification of systemd unit files or config for security agents
[AgentServiceNames]
List of endpoint protection service names (varies across deployments).
[AllowedAdminAccounts]
Accounts permitted to legitimately stop or reconfigure services.
AN1371
Analytic 1371
macOS
Detection of adversary disabling endpoint security tools by unloading launch agents/daemons, modifying configuration profiles, or disabling Gatekeeper/XProtect/logging settings, or removing endpoint agents followed by telemetry loss.
macos:unifiedlog
Execution of launchctl unload, kill, or removal of security agent daemons
macos:unifiedlog
Modification of system configuration profiles affecting security tools
[DaemonNames]
Expected security agent daemons (e.g., com.crowdstrike.falcon.Agent).
[TimeWindow]
Detection correlation period for multiple security tool disable actions.
AN1372
Analytic 1372
IaaS
Correlates control-plane API actions disabling cloud-native monitoring or sensor agents (CloudTrail, GuardDuty, Security Hub, Defender, monitoring agents), role abuse preceding disablement, or instance agent uninstall events
AWS:CloudTrail
Delete* / Stop*: DeleteAlarms, StopLogging, or DisableMonitoring API calls
[APIActions]
Customizable list of cloud provider API calls related to monitoring/alerting disablement.
[UserContext]
Distinguishes adversary actions from authorized DevOps/CloudOps activities.
AN1373
Analytic 1373
Containers
Detects disabling container runtime security controls, removing sidecar sensors, modifying seccomp/AppArmor profiles, mounting host proc/sys paths to interfere with host logging, or killing in-container monitoring agents.
kubernetes:audit
kubectl delete or patch of security pods/admission controllers
[NamespaceExclusions]
Exclusion of namespaces where temporary deletion of monitoring tools is legitimate (e.g., staging).
AN1374
Analytic 1374
Network Devices
Detects disabling AAA, syslog, SNMP traps, ACL logging, or security features on routers/switches/firewalls; correlates privileged login followed by configuration commit reducing visibility.
networkdevice:config
write: Startup configuration changes disabling security checks
networkdevice:syslog
no logging host, no aaa new-model, no snmp-server, commit
[ConfigBaseline]
Reference configuration state for detecting unauthorized modifications.
AN2044
Analytic 2044
ESXi
Detects esxcli commands disabling syslog, firewall, lockdown mode, or stopping hostd/vpxa; correlates command execution with reduced forwarding activity.
esxi:shell
esxcli system syslog config set/reload, services.sh restart/stop
esxi:hostd
service state change
[ExpectedAdminIPs]
Authorized management sources.