Elastic Agent Service Terminated

process where event.type == "start" and
(
  /* net, sc or wmic stopping or deleting Elastic Agent on Windows */
  (
    process.name : ("net.exe", "sc.exe", "wmic.exe", "powershell.exe", "taskkill.exe", "PsKill.exe", "ProcessHacker.exe") and
    process.args : ("stopservice", "uninstall", "stop", "disabled", "Stop-Process", "terminate", "suspend") and
    process.args : ("elasticendpoint", "Elastic Agent", "elastic-agent", "elastic-endpoint")
  ) or

  /* direct uninstallation of Elastic Agent or Elastic Endpoint on Windows */
  (
    host.os.type == "windows" and
    process.name : ("elastic-agent.exe", "endpoint-security.exe", "elastic-endpoint.exe") and
    process.args : "uninstall" and
    /* exclude legitimate Elastic-managed reinstall, upgrade, and uninstall subprocesses */
    not (
      process.parent.code_signature.trusted == true and
      process.parent.code_signature.subject_name == "Elasticsearch, Inc." and
      (
        (
          process.name : "elastic-agent.exe" and process.args : "--force" and
          process.parent.name : "elastic-agent.exe" and process.parent.args : "install" and
          process.parent.args : ("--force", "-f")
        ) or
        (
          process.parent.name : "endpoint-security.exe" and
          process.executable : "*\\components\\previous\\elastic-endpoint.exe" and
          process.args : "--keepstate" and process.parent.args : "--upgrade"
        ) or
        (
          process.name : "endpoint-security.exe" and process.parent.name : "elastic-agent.exe" and
          process.parent.args : "uninstall"
        )
      )
    )
  ) or

  /* service or systemctl used to stop Elastic Agent on Linux */
  (
    process.name in ("systemctl", "service", "chkconfig", "update-rc.d") and
    process.args : ("elastic-agent", "elastic-agent.service", "ElasticEndpoint") and
    process.args : ("stop", "disable", "remove", "off", "kill", "mask") and
    not (
      process.parent.executable : "/opt/Elastic/Agent/data/elastic-agent-*/components/previous/elastic-endpoint" and
      process.parent.args : "uninstall" and
      process.parent.args : "--keepstate"
    )
  ) or
  
  /* pkill, killall used to stop Elastic Agent or Endpoint on Linux */
  (process.name in ("pkill", "killall", "kill") and process.args : ("elastic-agent", "elastic-endpoint")) or

  /* Unload Elastic Defend extension on MacOS */
  (process.name : "kextunload" and process.args : "com.apple.iokit.EndpointSecurity")
)