Link to Rule

https://github.com/elastic/detection-rules/blob/main/rules/cross-platform/defense_evasion_elastic_agent_service_terminated.toml

Rule Tuning Type

False Negatives - Enhancing detection of true threats that were previously missed.

Description

I believe we should include

systemctl stop elastic-agent.service

in this rule to also detect if a user stops the service, as tab completion for systemctl matches on elastic-agent.service, while the rule currently only catches elastic-agent.

Example Data

No response