Windows PowerShell Stop-Service Used to Stop a Service
Flags PowerShell executions that include the Stop-Service cmdlet to stop a Windows service.
FreeReviewedSigma · Low · v1
- Product
- windows
- Category
- process_creation
- Author
- Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-03-05
- Updated
- 2026-07-30
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process executions of PowerShell (powershell.exe/pwsh.exe) where the command line contains the Stop-Service cmdlet. Stopping services can disrupt availability and may be used as part of impact or pre-steps to other actions. It relies on Windows process creation telemetry, including the executed image name and the full command line.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-powershell-stop-service-used-to-stop-a-service-c49c5062
title: Windows PowerShell Stop-Service Used to Stop a Service
id: 551041c9-4ed1-4b30-8705-55e777ee8432
related:
- id: eb87818d-db5d-49cc-a987-d5da331fbd90
type: obsolete
- id: c49c5062-0966-4170-9efd-9968c913a6cf
type: derived
status: test
description: This rule identifies process executions of PowerShell (powershell.exe/pwsh.exe) where the command line contains the Stop-Service cmdlet. Stopping services can disrupt availability and may be used as part of impact or pre-steps to other actions. It relies on Windows process creation telemetry, including the executed image name and the full command line.
references:
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/stop-service?view=powershell-7.4
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_stop_service.yml
author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-05
tags:
- attack.impact
- attack.t1489
logsource:
category: process_creation
product: windows
detection:
selection_sc_net_img:
- OriginalFileName:
- PowerShell.EXE
- pwsh.dll
- Image|endswith:
- \powershell.exe
- \pwsh.exe
selection_cli:
CommandLine|contains: "Stop-Service "
condition: all of selection_*
falsepositives:
- There are many legitimate reasons to stop a service. This rule isn't looking for any suspicious behaviour in particular. Filter legitimate activity accordingly
level: low
license: DRL-1.1