decay: 14-scenario-a — BLOCKED: Sysmon cannot be stopped

[jayelbotvibe-web]

14-scenario-a-source-death

BLOCKED — Sysmon64 service cannot be stopped on the Windows victim.

Attempts made

1. Stop-Service Sysmon64 — protected error
2. sc stop — access denied
3. sc stop as SYSTEM via scheduled task — no effect
4. net stop — no effect
5. taskkill /f as SYSTEM — process killed but SCM restarts it immediately
6. Stop-Process -Force as SYSTEM — same, auto-restarts

Root cause

• Sysmon driver is boot-start with auto-recovery
• SwiftOnSecurity config likely has tamper protection
• windows-vm user is not administrator

What's needed

• Admin credentials for the Windows VM
• OR alternative scenario (agent-side source death, config change)