Windows PowerShell Stop-Service Used to Stop a Service

Flags PowerShell executions that include the Stop-Service cmdlet to stop a Windows service.

FreeUnreviewedSigmalowv1

windows-powershell-stop-service-used-to-stop-a-service-c49c5062

title: Windows PowerShell Stop-Service Used to Stop a Service
id: 551041c9-4ed1-4b30-8705-55e777ee8432
related:
  - id: eb87818d-db5d-49cc-a987-d5da331fbd90
    type: obsolete
  - id: c49c5062-0966-4170-9efd-9968c913a6cf
    type: derived
status: test
description: This rule identifies process executions of PowerShell (powershell.exe/pwsh.exe) where the command line contains the Stop-Service cmdlet. Stopping services can disrupt availability and may be used as part of impact or pre-steps to other actions. It relies on Windows process creation telemetry, including the executed image name and the full command line.
references:
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/stop-service?view=powershell-7.4
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_stop_service.yml
author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-05
tags:
  - attack.impact
  - attack.t1489
logsource:
  category: process_creation
  product: windows
detection:
  selection_sc_net_img:
    - OriginalFileName:
        - PowerShell.EXE
        - pwsh.dll
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
  selection_cli:
    CommandLine|contains: "Stop-Service "
  condition: all of selection_*
falsepositives:
  - There are many legitimate reasons to stop a service. This rule isn't looking for any suspicious behaviour in particular. Filter legitimate activity accordingly
level: low
license: DRL-1.1

What it detects

This rule identifies process executions of PowerShell (powershell.exe/pwsh.exe) where the command line contains the Stop-Service cmdlet. Stopping services can disrupt availability and may be used as part of impact or pre-steps to other actions. It relies on Windows process creation telemetry, including the executed image name and the full command line.

Known false positives

There are many legitimate reasons to stop a service. This rule isn't looking for any suspicious behaviour in particular. Filter legitimate activity accordingly

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.