Windows Service Control Binary Usage: Stop/Pause/Disable/Delete on Protected Services
Alerts on net/sc/wmic/PowerShell commands that stop, pause, delete, or disable Windows services, especially security/backup services.
FreeReviewedSigma · High · v3
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), frack113 , X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-09-01
- Updated
- 2026-10-17
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows processes (net/sc/wmic/PowerShell and related binaries) being used with command-line arguments that stop, pause, disable, or delete Windows services. This matters because attackers may impair defenses by tampering with security, backup, or other critical services to enable persistence or ransomware activity. It relies on process creation telemetry, including the executable image name and command-line content, to match service-control actions targeting a predefined list of high-value service names.
Reporting behind it
- trendmicro.comhttps://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus/Genshin%20Impact%20Figure%2010.jpg
- trellix.comhttps://www.trellix.com/en-sg/about/newsroom/stories/threat-labs/lockergoga-ransomware-family-used-in-targeted-attacks.html
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
- research.nccgroup.comhttps://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
- virustotal.comhttps://www.virustotal.com/gui/file/38283b775552da8981452941ea74191aa0d203edd3f61fb2dee7b0aea3514955
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/win32/cimwin32prov/delete-method-in-class-win32-service
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_service_tamper.yml
Changelog
v3- v3Candidate ingested via manual entry.2026-10-17
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-suspicious-service-stop-pause-delete-disable-via-net-sc-ce72ef99
title: "Windows Service Control Binary Usage: Stop/Pause/Disable/Delete on Protected Services"
id: e5bcda22-fd47-4c45-9af5-e19f9c463fd8
related:
- id: eb87818d-db5d-49cc-a987-d5da331fbd90
type: obsolete
- id: 6783aa9e-0dc3-49d4-a94a-8b39c5fd700b
type: obsolete
- id: 7fd4bb39-12d0-45ab-bb36-cebabc73dc7b
type: obsolete
- id: ce72ef99-22f1-43d4-8695-419dcb5d9330
type: derived
status: test
description: This rule flags Windows processes (net/sc/wmic/PowerShell and related binaries) being used with command-line arguments that stop, pause, disable, or delete Windows services. This matters because attackers may impair defenses by tampering with security, backup, or other critical services to enable persistence or ransomware activity. It relies on process creation telemetry, including the executable image name and command-line content, to match service-control actions targeting a predefined list of high-value service names.
references:
- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus/Genshin%20Impact%20Figure%2010.jpg
- https://www.trellix.com/en-sg/about/newsroom/stories/threat-labs/lockergoga-ransomware-family-used-in-targeted-attacks.html
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
- https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
- https://www.virustotal.com/gui/file/38283b775552da8981452941ea74191aa0d203edd3f61fb2dee7b0aea3514955
- https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/delete-method-in-class-win32-service
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_service_tamper.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113 , X__Junior (Nextron Systems), Huntrule Team
date: 2022-09-01
modified: 2026-10-17
tags:
- attack.impact
- attack.defense-impairment
- attack.t1489
- attack.t1685
logsource:
category: process_creation
product: windows
detection:
selection_tools_img:
- OriginalFileName:
- net.exe
- net1.exe
- PowerShell_ISE.EXE
- PowerShell.EXE
- psservice.exe
- pwsh.dll
- sc.exe
- wmic.exe
- Image|endswith:
- \net.exe
- \net1.exe
- \PowerShell_ISE.EXE
- \powershell.exe
- \PsService.exe
- \PsService64.exe
- \pwsh.exe
- \sc.exe
- \wmic.exe
selection_tools_cli:
- CommandLine|contains:
- " delete "
- .delete()
- " pause "
- " stop "
- "Stop-Service "
- "Remove-Service "
- CommandLine|contains|all:
- config
- start=disabled
selection_services:
CommandLine|contains:
- 143Svc
- aakore
- Acronis VSS Provider
- AcronisActiveProtectionService
- AcronisAgent
- AcronisCyberProtectionService
- AcrSch2Svc
- AdobeARMservice
- AHS Service
- Antivirus
- Apache4
- ARSM
- aswBcc
- AteraAgent
- Avast Business Console Client Antivirus Service
- avast! Antivirus
- AVG Antivirus
- avgAdminClient
- AvgAdminServer
- AVP1
- BackupExec
- bedbg
- BITS
- BrokerInfrastructure
- CASLicenceServer
- CASWebServer
- Client Agent 7.60
- Core Browsing Protection
- Core Mail Protection
- Core Scanning Server
- DCAgent
- dwmrcs
- EhttpSr
- ekrn
- Enterprise Client Service
- epag
- EPIntegrationService
- EPProtectedService
- EPRedline
- EPSecurityService
- EPUpdateService
- EraserSvc11710
- EsgShKernel
- ESHASRV
- FA_Scheduler
- FirebirdGuardianDefaultInstance
- FirebirdServerDefaultInstance
- FontCache3.0.0.0
- HealthTLService
- hmpalertsvc
- HMS
- HostControllerService
- hvdsvc
- IAStorDataMgrSvc
- IBMHPS
- ibmspsvc
- IISAdmin
- IMANSVC
- IMAP4Svc
- instance2
- KAVFS
- KAVFSGT
- kavfsslp
- KeyIso
- klbackupdisk
- klbackupflt
- klflt
- klhk
- KLIF
- klim6
- klkbdflt
- klmouflt
- klnagent
- klpd
- kltap
- KSDE1.0.0
- LogProcessorService
- M8EndpointAgent
- macmnsvc
- masvc
- MBAMService
- MBCloudEA
- MBEndpointAgent
- McAfeeDLPAgentService
- McAfeeEngineService
- MCAFEEEVENTPARSERSRV
- McAfeeFramework
- MCAFEETOMCATSRV530
- McShield
- McTaskManager
- mfefire
- mfemms
- mfevto
- mfevtp
- mfewc
- MMS
- mozyprobackup
- mpssvc
- MSComplianceAudit
- MSDTC
- MsDtsServer
- MSExchange
- msftesq1SPROO
- msftesql$PROD
- msftesql$SQLEXPRESS
- MSOLAP$SQL_2008
- MSOLAP$SYSTEM_BGC
- MSOLAP$TPS
- MSOLAP$TPSAMA
- MSOLAPSTPS
- MSOLAPSTPSAMA
- mssecflt
- MSSQ!I.SPROFXENGAGEMEHT
- MSSQ0SHAREPOINT
- MSSQ0SOPHOS
- MSSQL
- MSSQLFDLauncher$
- MySQL
- NanoServiceMain
- NetMsmqActivator
- NetPipeActivator
- netprofm
- NetTcpActivator
- NetTcpPortSharing
- ntrtscan
- nvspwmi
- ofcservice
- Online Protection System
- OracleClientCache80
- OracleDBConsole
- OracleMTSRecoveryService
- OracleOraDb11g_home1
- OracleService
- OracleVssWriter
- osppsvc
- PandaAetherAgent
- PccNTUpd
- PDVFSService
- POP3Svc
- postgresql-x64-9.4
- POVFSService
- PSUAService
- Quick Update Service
- RepairService
- ReportServer
- ReportServer$
- RESvc
- RpcEptMapper
- sacsvr
- SamSs
- SAVAdminService
- SAVService
- ScSecSvc
- SDRSVC
- SearchExchangeTracing
- sense
- SentinelAgent
- SentinelHelperService
- SepMasterService
- ShMonitor
- Smcinst
- SmcService
- SMTPSvc
- SNAC
- SntpService
- Sophos
- SQ1SafeOLRService
- SQL Backups
- SQL Server
- SQLAgent
- SQLANYs_Sage_FAS_Fixed_Assets
- SQLBrowser
- SQLsafe
- SQLSERVERAGENT
- SQLTELEMETRY
- SQLWriter
- SSISTELEMETRY130
- SstpSvc
- storflt
- svcGenericHost
- swc_service
- swi_filter
- swi_service
- swi_update
- Symantec
- sysmon
- TeamViewer
- Telemetryserver
- ThreatLockerService
- TMBMServer
- TmCCSF
- TmFilter
- TMiCRCScanService
- tmlisten
- TMLWCSService
- TmPfw
- TmPreFilter
- TmProxy
- TMSmartRelayService
- tmusa
- Tomcat
- Trend Micro Deep Security Manager
- TrueKey
- UFNet
- UI0Detect
- UniFi
- UTODetect
- vds
- Veeam
- VeeamDeploySvc
- Veritas System Recovery
- vmic
- VMTools
- vmvss
- VSApiNt
- VSS
- W3Svc
- wbengine
- WdNisSvc
- WeanClOudSve
- Weems JY
- WinDefend
- wmms
- wozyprobackup
- WPFFontCache_v0400
- WRSVC
- wsbexchange
- WSearch
- wscsvc
- Zoolz 2 Service
condition: all of selection_*
falsepositives:
- Administrators or tools shutting down the services due to upgrade or removal purposes. If you experience some false positive, please consider adding filters to the parent process launching this command and not removing the entry
level: high
license: DRL-1.1