Detect a defensive service terminating unexpectedly

Siemphony@siemphonyhighT1687unverified

AN2038 is about a security product being degraded by something other than its own management interface: "service crashes, unexpected restarts, driver unloads, telemetry gaps". This rule takes the second leg of that directly — the Service Control Manager reporting that a defensive service died without having been asked to stop (System 7031 and 7034). That is the observable that separates T1687 from T1562.001: `sc stop WinDefend`, `net stop wscsvc` and the Stop-Service cmdlet all use the sanctioned control path and produce 7035/7036, never a 7031, so a rule built on the control interface selects for the complement of this technique. Exploiting a parsing bug in the scanner, a malformed IOCTL to a vulnerable minifilter, or a bring-your-own-vulnerable- driver kill of the agent all end the same way: the service is gone and nobody sent it a control. `param1` is the service display name in the SCM message, which is why the terms are display-name fragments rather than short names. Populate it with the site's own agents — that is exactly MITRE's ProtectedServiceList knob, and no corpus rule can guess a fleet's EDR. The driver-unload arm (Sysmon EID 6 on a vendor minifilter) and the telemetry-gap arm both need a different logsource or a timer and are not expressed here. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0900, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Splunk · SPL

Run this as a search.

index=* (Provider_Name="Service Control Manager" AND (EventID="7031" OR EventID="7034") AND (param1="*Defender*" OR param1="*Firewall*" OR param1="*Security Center*" OR param1="*Windows Security*" OR param1="*System Guard*" OR param1="*Sysmon*" OR param1="*Windows Event Log*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(winlog.provider_name) == "service control manager" AND (event.code == 7031 OR event.code == 7034) AND (TO_LOWER(param1) LIKE "*defender*" OR TO_LOWER(param1) LIKE "*firewall*" OR TO_LOWER(param1) LIKE "*security center*" OR TO_LOWER(param1) LIKE "*windows security*" OR TO_LOWER(param1) LIKE "*system guard*" OR TO_LOWER(param1) LIKE "*sysmon*" OR TO_LOWER(param1) LIKE "*windows event log*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Provider_Name" type="pcre2">(?i)^Service Control Manager$</field>    <field name="EventID" type="pcre2">(?i)(^7031$|^7034$)</field>    <field name="param1" type="pcre2">(?i)(Defender|Firewall|Security Center|Windows Security|System Guard|Sysmon|Windows Event Log)</field>    <description>Detect a defensive service terminating unexpectedly</description>    <mitre>      <id>T1687</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. `param1` has no Sentinel column: System-channel message parameters live inside `ParameterXml`, not in a column of their own. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: system / windows
Level: high
Category: defense_evasion_disable_tools
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 30 Aug 2026
Rule ID: c556764b-50cf-4d0b-a281-0e89a08eb6d8

ATT&CKT1687

T1687Exploitation for Defense Impairment

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondefense evasion disable tools

defense evasion disable toolsAI draft — unreviewed

01 · What this rule detects

This rule matches a single process-creation event in which a service-control binary, an action verb and the name of a Windows defensive component all appear together. It is the "suspicious interaction with a security product" precursor from MITRE's AN2038. Read the overlap section before you deploy this. T1687 is exploitation for defense impairment — triggering a bug in a security product to crash it. sc.exe stop WinDefend is not exploitation. This rule detects the precursor MITRE names, not the technique in its own title.

02 · Telemetry you need

process_creation / windows with the command line captured. AN2038 lists
For the real analytic, untouched by this rule: System EventID 7035, Sysmon

03 · How the logic works

Three selections, all ANDed:

Why three selections instead of one. Each list alone is worthless. sc.exe runs on healthy machines, stop appears in a thousand command lines, WinDefend appears in inventory queries. The conjunction — this tool, doing this thing, to this component, in one event — is what carries the signal. Why `/im` sits in a list of verbs. It is the odd one out on purpose. taskkill /f /im MsMpEng.exe contains none of the other five, so without /im the taskkill path never matches. The list is not "verbs", it is "tokens showing the tool is being used destructively". config is there for the same reason: sc.exe config WinDefend start= disabled stops nothing today and everything after the next reboot. Why `contains` on the targets rather than exact match. Sysmon's service is Sysmon, Sysmon64, or an operator-chosen name from -i; contains 'Sysmon' catches any variant that kept the substring. The same looseness means a binPath= pointing at C:\Tools\Sysmon\ trips the rule at install time. The blind spot this shape creates. The target must be named on the command line. taskkill /f /pid 4242 kills MsMpEng by PID and matches nothing. PowerShell's Stop-Service, Set-MpPreference, wmic service call and reg.exe edits are all absent from selection_tool. This is a narrow rule about classic CLI service control.

04 · Common false positives

Agent and AV upgrades, which stop and replace their own services from an
Administrators troubleshooting by hand during a support call. No crash
Golden image and build pipelines that disable Defender or Sysmon before
Config management agents reconciling start types. sc.exe config MpsSvc is

05 · Detection maturity

tier_1: , with a sharper caveat than the rest of this corpus. Never executed against a log line, and mapped to a technique it can only partially evidence.
tier_2: is baselining plus attribution hygiene: run it read-only, suppress build pipelines and the patch agent by parent process, extend `ProtectedServiceList` to your own agents, and decide deliberately whether these alerts are T1687 or T1562.001.
tier_3: ** is MITRE's actual analytic — join this precursor to System 7035, Sysmon EventID 6 driver unloads and heartbeat gaps within CrashCorrelationWindow and TelemetryGapThreshold. Only with the second leg present can you say "exploitation" and mean it.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE's `ProtectedServiceList` knob is the target list. Extend it with
Pair it with the parent process of the sanctioned updater rather than
Split config into its own lower-severity rule — most volume, least urgency.
Add User and IntegrityLevel. The same command from a helpdesk admin and

Declared by the author

The security agent crashing on its own. A bad definition update, an out-of-memory condition, a driver conflict after a kernel patch, or a botched self-upgrade all produce exactly this event with no adversary present, and across a large fleet they are the majority of matches. MITRE's ProtectedServiceList knob says which services to watch and nothing about why they died, so this rule cannot separate a crash from an induced crash on its own — the CrashCorrelationWindow leg, correlating a preceding suspicious interaction, is what would, and Sigma has no construct for it.
Abrupt power transitions. Forced shutdowns, hypervisor snapshot restores and non-persistent VDI pool recycles make the SCM record services as terminated unexpectedly, in bursts, at the same times of day.
An administrator or a management agent killing a hung security service with taskkill /f rather than stopping it. That is a forced but sanctioned stop — T1562.001, not exploitation — and it reaches the SCM as the same 7031.
Any service whose display name merely contains one of the fragments. Matching on Firewall or Windows Security picks up third-party products with those words in their names, which may or may not be defensive components a site cares about.

Noise checknot tested

No baseline event covers this rule’s log type (system / windows), so the rule was never evaluated. This is missing data, not a clean result — nothing was checked either way.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verificationnone

Never run

The lab has not evaluated this composition. A run needs a dataset of its log type — a capture of the technique it claims, or the benign baseline — and not every rule has one. Some are also held back by the evaluator’s own safety limits.

Other compositions here have been run and some carry the badge — this one has not, so nothing about it has been shown either way. Read the rule and its noise check on their own terms; silence here is the absence of evidence, not evidence of a problem.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1687, evaluated against their — events.

Share this rule

/u/siemphony/c556764b-50cf-4d0b-a281-0e89a08eb6d8

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Detect a defensive service terminating unexpectedly

The detection

detection.yml

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Sentinel · KQL

Community

Verdicts from engineers who deployed it