Stopping security services

evasion_security_service_stop

Identifies which EDR/AV/telemetry services are actually running on this host and attempts to stop up to three of them, then restarts them. Tamper protection is expected to refuse; if a service does stop, that is the finding. The restart is recorded in a revert plan first, so the supervisor restores the service even if this worker is killed.

Severity critical how bad it would be if it were real

Expected outcome Something should prevent it

Platforms 3 macOS, Linux, Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

--i-understand
Needs explicit consent: this test changes machine state or fetches real offensive tooling.
wants admin
Only fully works with administrative rights. It still runs without them — the refusal is itself informative — and the report says which it was.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1489	Service Stop	Impact	coverage statistics
T1562.001	Disable or Modify Tools	Defense Evasion	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other defence evasion tests

Other tests in the Defence evasion category.
Test	What it does	Severity
Adding a Defender exclusion path evasion_defender_exclusion	Adds the sandbox directory to Microsoft Defender's exclusion list, verifies whether it took effect, and removes it again. Adding an exclusion is how c…	critical
Disabling Defender real-time monitoring evasion_defender_realtime_disable	Attempts to turn off Microsoft Defender's real-time monitoring through Set-MpPreference and turns it back on again. With tamper protection enabled thi…	critical
In-memory AMSI bypass attempt evasion_amsi_bypass_attempt	Runs the published AMSI bypass one-liner in PowerShell and then feeds AMSI's own test string through Invoke-Expression, to establish whether script sc…	high
Clearing an event log evasion_event_log_clear	Clears the Windows Application event log, which is the anti-forensic step that follows a successful intrusion and raises event 1102. This cannot be un…	high
Disabling the host firewall evasion_firewall_disable	Turns the host firewall off and immediately back on, using the platform's own tool (netsh advfirewall, socketfilterfw, ufw or firewalld). The re-enabl…	high
Timestomping a file evasion_timestomp	Backdates the modification and access times of a sandbox file to 2009 and verifies the change, the standard anti-forensic step for making a dropped fi…	medium

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.