Research

Creating, Disabling and Deleting a Harmless Windows Service: What a Commercial EDR Sensor Records

What a commercial EDR sensor recorded for a benign Windows service on one lab host (create, failed start, refused stop request, disable, delete): process starts for each test command in the 10:30:08 AM PT run, with a service-stopped event and an autostart-registry update seen in that run only.

Sennin Security Labsv1.0October 20, 20267 min read

A plain-English, vendor-neutral account of what a commercial endpoint detection and response (EDR) sensor records on Windows when an operator creates, tries to start, sends a stop request to, disables and deletes a harmless lab service. EDR is security software that watches each computer and records what programs do; on Windows a service is a background program controlled with sc.exe. The product is not named.

The 10:31:11 AM PT repeat ran about one minute after the first run, most likely as an accidental duplicate send, and is not an independent run. Our 30-minute quiet rule was not met for it, and our check wrongly reported a pass. The 10:30:08 AM PT run carries the result.

The host frames on this page come from the 10:31:11 AM PT repeat (not from the 10:30:08 AM PT result run).

Because the service never reached a running state, this test does not show what the sensor records when a running service is stopped. The service-stopped event does not show a running service being stopped, and its cause was not determined.

The operating system's built-in antivirus was also running in active mode, with real-time protection on, during both runs. It may block, log or quarantine activity independently of the EDR sensor under test, and it may affect what that sensor records or alerts on.

A background vulnerability scanner was also installed on the host; its activity was not part of the test, and none of it appears in the sensor records for either run.

The host's own process-creation auditing was off, so the host's event log has no process-start records to compare with the sensor's.

The sensor attached technique labels to some records; none produced an alert. These are records from one host, one sensor build and one configuration, and do not describe any customer environment.

Environment

One Windows lab host, a commercial EDR sensor under test. Identifiers that could create exposure are redacted; the host name is shown as [HOST] and the sensor's service name as [EDR-SENSOR-SERVICE]. Methods line: tested against a commercial EDR sensor; vendor not named.

Method and commands

An operator created a harmless dummy service whose program is cmd.exe /c exit 0 (demand start), tried to start it, sent a stop request, disabled it, then restored by re-setting start type to demand and deleting it. The host confirmed the dummy and its registry key were absent afterward, and that the service list (name, state and start type) matched the list captured at the start of that same run, excluding the dummy. Event logs and other host state were not compared. The commands below are the service-control steps:

# SSS-RC-2026-041 Part 01 — benign Windows dummy-service create/start/stop/disable/delete.
# Target ONLY the lab-owned dummy service. Never touch any real security service.
# Commands shown are the host service-control steps; the full lab runner adds
# baseline, observe and restore checks around them.

$Name = 'sss-lab-dummy-041'

# Create (demand start; program exits immediately)
sc.exe create $Name binPath= "cmd.exe /c exit 0" start= demand DisplayName= "SSS Lab Dummy 041"
sc.exe description $Name "SSS RC-2026-041 Part 1 dummy service - not a security product"
sc.exe qc $Name

# Start attempt (expected to fail with this binPath: 1053)
sc.exe start $Name

# Stimulus: stop request (refused when not started: 1062), then disable
sc.exe stop $Name
sc.exe config $Name start= disabled
sc.exe qc $Name

# Restore: re-set to demand, stop if needed, delete
sc.exe config $Name start= demand
sc.exe stop $Name
sc.exe delete $Name
sc.exe qc $Name

What the sealed sensor record shows (the October 20 run at 10:30:08 AM PT)

In the October 20 run at 10:30:08 AM PT, the EDR sensor under test recorded a process start for each of the 20 commands and programs the test launched, including every service-control command. It also recorded an autostart-registry update for the service's program path, and a service-stopped event about one second after the service was deleted. An alert check about 30 minutes later found no alerts for this host. An identical back-to-back repeat at 10:31:11 AM PT recorded the same 20 process starts, but the autostart-registry update and the service-stopped event did not appear in that pull. The 10:30:08 AM PT run carries the result.

Host evidence — rendered terminal output (redacted)

The frames below are rendered terminal output from the masked transcript of the 10:31:11 AM PT repeat (host frames; see disclosure 1); they are host output only. The quiet-30 frame (RTO-00) reads NOT PASS. The host's own checks show that the dummy was created, the start failed (1053), the stop was refused (1062), disable succeeded, and after restore the dummy and its registry key were absent. The service list (name, state and start type) matched the list captured at the start of that same run, excluding the dummy. Bracketed tokens such as [HOST] and [EDR-SENSOR-SERVICE] are redactions.

### CREATE | 2026-10-20 10:31:15 AM PT | 2026-10-20T17:31:15Z
[HOST]$ sc.exe create sss-lab-dummy-041 binPath= "cmd.exe /c exit 0" start= demand DisplayName= "SSS Lab Dummy 041"
[SC] CreateService SUCCESS
sc_create_exit=0
[HOST]$ sc.exe qc sss-lab-dummy-041
SERVICE_NAME: sss-lab-dummy-041
        START_TYPE         : 3   DEMAND_START
        BINARY_PATH_NAME   : cmd.exe /c exit 0
        DISPLAY_NAME       : SSS Lab Dummy 041
IMAGEPATH_OK: lab-controlled cmd.exe /c exit 0

### START | 2026-10-20 10:31:16 AM PT | 2026-10-20T17:31:16Z
[HOST]$ sc.exe start sss-lab-dummy-041
[SC] StartService FAILED 1053:
The service did not respond to the start or control request in a timely fashion.
sc_start_exit=1053
Status    : Stopped
StartType : Manual

### STIMULUS-STOP | 2026-10-20 10:31:16 AM PT | 2026-10-20T17:31:16Z
[HOST]$ sc.exe stop sss-lab-dummy-041
[SC] ControlService FAILED 1062:
The service has not been started.
sc_stop_exit=1062

### STIMULUS-DISABLE | 2026-10-20 10:31:16 AM PT | 2026-10-20T17:31:16Z
[HOST]$ sc.exe config sss-lab-dummy-041 start= disabled
[SC] ChangeServiceConfig SUCCESS
sc_config_exit=0
        START_TYPE         : 4   DISABLED

### RESTORE-DIFF | 2026-10-20 10:31:19 AM PT | 2026-10-20T17:31:19Z
dummy_absent=True
dummy_reg_absent=True
---SERVICE-DIFF baseline vs after (excluding dummy)---
service_diff_lines=0
RESTORE_HOST_CHECKS_PASS

Note (Validation wording): the service list (name, state and start type)
matched the list captured at the start of that same run, excluding the dummy.
Event logs and other host state were not compared.

Limitations

• This is one Windows lab host; it is not a statement about Linux, any other host, or any customer environment.
• The 10:31:11 AM PT repeat is not an independent run (see the disclosures after the claim). The 10:30:08 AM PT run carries the result.
• Because the service never reached a running state, this test does not show what the sensor records when a running service is stopped.
• The operating system's built-in antivirus was also active during both runs and may affect what the EDR sensor under test records or alerts on.
• The sensor recorded activity and raised no alert in the window checked; that does not mean it "missed," "ignored" or "allows" service tampering, and it is not a statement that the alerting path would stay silent for genuine tampering.
• No product comparison, kill score or detection-gap claim is made or supported.

Methods and limitations

References

1. SSS-RC-2026-041 Part 01 Validation memo (VAL-01), PUBLICATION READY YES 11:09 AM PT
2. Public pack v5 (2026-10-20 10:57 AM PT)
3. SSS-RC-2026-036 / 037 cross-run precedent

Want to know if your endpoint defenses still work?

We test them in your environment and give you a plain written answer.