Windows Service Control Binary Usage: Stop/Pause/Disable/Delete on Protected Services

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1489Service Stop

What it detects

This rule flags Windows processes (net/sc/wmic/PowerShell and related binaries) being used with command-line arguments that stop, pause, disable, or delete Windows services. This matters because attackers may impair defenses by tampering with security, backup, or other critical services to enable persistence or ransomware activity. It relies on process creation telemetry, including the executable image name and command-line content, to match service-control actions targeting a predefined list of high-value service names.

Reporting behind it

Related detections9 linkedT1685 — drag to rearrange

Malicious Massive Processes Termination Burst (via process_creation)

Malicious Service Deactivation - Command (via process_creation)

Malicious Massive Services Deletion Burst (via process_creation)

Malicious Security Service Tampering via wmic PathName Query (via process_creation)

Malicious Massive Services Termination Burst (via process_creation)

Malicious Microsoft Defender Disabled via Registry DisableAntiSpyware (via process_creation)

Suspicious Termination of Defender Tray Process via Taskkill

Malicious Windows Defender Disablement via MpCmdRun RemoveDefinitions

Malicious Unsigned VIB Installation on ESXi Host via esxcli (via process_creation)

Windows Service Control Binary Usage: Stop/Pause/Disable/Delete on Protected Services

Pivot detection · T1685 · 9 related

Changelog

v3

v3
Candidate ingested via manual entry.2026-10-17
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-suspicious-service-stop-pause-delete-disable-via-net-sc-ce72ef99

title: "Windows Service Control Binary Usage: Stop/Pause/Disable/Delete on Protected Services"
id: e5bcda22-fd47-4c45-9af5-e19f9c463fd8
related:
  - id: eb87818d-db5d-49cc-a987-d5da331fbd90
    type: obsolete
  - id: 6783aa9e-0dc3-49d4-a94a-8b39c5fd700b
    type: obsolete
  - id: 7fd4bb39-12d0-45ab-bb36-cebabc73dc7b
    type: obsolete
  - id: ce72ef99-22f1-43d4-8695-419dcb5d9330
    type: derived
status: test
description: This rule flags Windows processes (net/sc/wmic/PowerShell and related binaries) being used with command-line arguments that stop, pause, disable, or delete Windows services. This matters because attackers may impair defenses by tampering with security, backup, or other critical services to enable persistence or ransomware activity. It relies on process creation telemetry, including the executable image name and command-line content, to match service-control actions targeting a predefined list of high-value service names.
references:
  - https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus/Genshin%20Impact%20Figure%2010.jpg
  - https://www.trellix.com/en-sg/about/newsroom/stories/threat-labs/lockergoga-ransomware-family-used-in-targeted-attacks.html
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
  - https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
  - https://www.virustotal.com/gui/file/38283b775552da8981452941ea74191aa0d203edd3f61fb2dee7b0aea3514955
  - https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/delete-method-in-class-win32-service
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_service_tamper.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113 , X__Junior (Nextron Systems), Huntrule Team
date: 2022-09-01
modified: 2026-10-17
tags:
  - attack.impact
  - attack.defense-impairment
  - attack.t1489
  - attack.t1685
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools_img:
    - OriginalFileName:
        - net.exe
        - net1.exe
        - PowerShell_ISE.EXE
        - PowerShell.EXE
        - psservice.exe
        - pwsh.dll
        - sc.exe
        - wmic.exe
    - Image|endswith:
        - \net.exe
        - \net1.exe
        - \PowerShell_ISE.EXE
        - \powershell.exe
        - \PsService.exe
        - \PsService64.exe
        - \pwsh.exe
        - \sc.exe
        - \wmic.exe
  selection_tools_cli:
    - CommandLine|contains:
        - " delete "
        - .delete()
        - " pause "
        - " stop "
        - "Stop-Service "
        - "Remove-Service "
    - CommandLine|contains|all:
        - config
        - start=disabled
  selection_services:
    CommandLine|contains:
      - 143Svc
      - aakore
      - Acronis VSS Provider
      - AcronisActiveProtectionService
      - AcronisAgent
      - AcronisCyberProtectionService
      - AcrSch2Svc
      - AdobeARMservice
      - AHS Service
      - Antivirus
      - Apache4
      - ARSM
      - aswBcc
      - AteraAgent
      - Avast Business Console Client Antivirus Service
      - avast! Antivirus
      - AVG Antivirus
      - avgAdminClient
      - AvgAdminServer
      - AVP1
      - BackupExec
      - bedbg
      - BITS
      - BrokerInfrastructure
      - CASLicenceServer
      - CASWebServer
      - Client Agent 7.60
      - Core Browsing Protection
      - Core Mail Protection
      - Core Scanning Server
      - DCAgent
      - dwmrcs
      - EhttpSr
      - ekrn
      - Enterprise Client Service
      - epag
      - EPIntegrationService
      - EPProtectedService
      - EPRedline
      - EPSecurityService
      - EPUpdateService
      - EraserSvc11710
      - EsgShKernel
      - ESHASRV
      - FA_Scheduler
      - FirebirdGuardianDefaultInstance
      - FirebirdServerDefaultInstance
      - FontCache3.0.0.0
      - HealthTLService
      - hmpalertsvc
      - HMS
      - HostControllerService
      - hvdsvc
      - IAStorDataMgrSvc
      - IBMHPS
      - ibmspsvc
      - IISAdmin
      - IMANSVC
      - IMAP4Svc
      - instance2
      - KAVFS
      - KAVFSGT
      - kavfsslp
      - KeyIso
      - klbackupdisk
      - klbackupflt
      - klflt
      - klhk
      - KLIF
      - klim6
      - klkbdflt
      - klmouflt
      - klnagent
      - klpd
      - kltap
      - KSDE1.0.0
      - LogProcessorService
      - M8EndpointAgent
      - macmnsvc
      - masvc
      - MBAMService
      - MBCloudEA
      - MBEndpointAgent
      - McAfeeDLPAgentService
      - McAfeeEngineService
      - MCAFEEEVENTPARSERSRV
      - McAfeeFramework
      - MCAFEETOMCATSRV530
      - McShield
      - McTaskManager
      - mfefire
      - mfemms
      - mfevto
      - mfevtp
      - mfewc
      - MMS
      - mozyprobackup
      - mpssvc
      - MSComplianceAudit
      - MSDTC
      - MsDtsServer
      - MSExchange
      - msftesq1SPROO
      - msftesql$PROD
      - msftesql$SQLEXPRESS
      - MSOLAP$SQL_2008
      - MSOLAP$SYSTEM_BGC
      - MSOLAP$TPS
      - MSOLAP$TPSAMA
      - MSOLAPSTPS
      - MSOLAPSTPSAMA
      - mssecflt
      - MSSQ!I.SPROFXENGAGEMEHT
      - MSSQ0SHAREPOINT
      - MSSQ0SOPHOS
      - MSSQL
      - MSSQLFDLauncher$
      - MySQL
      - NanoServiceMain
      - NetMsmqActivator
      - NetPipeActivator
      - netprofm
      - NetTcpActivator
      - NetTcpPortSharing
      - ntrtscan
      - nvspwmi
      - ofcservice
      - Online Protection System
      - OracleClientCache80
      - OracleDBConsole
      - OracleMTSRecoveryService
      - OracleOraDb11g_home1
      - OracleService
      - OracleVssWriter
      - osppsvc
      - PandaAetherAgent
      - PccNTUpd
      - PDVFSService
      - POP3Svc
      - postgresql-x64-9.4
      - POVFSService
      - PSUAService
      - Quick Update Service
      - RepairService
      - ReportServer
      - ReportServer$
      - RESvc
      - RpcEptMapper
      - sacsvr
      - SamSs
      - SAVAdminService
      - SAVService
      - ScSecSvc
      - SDRSVC
      - SearchExchangeTracing
      - sense
      - SentinelAgent
      - SentinelHelperService
      - SepMasterService
      - ShMonitor
      - Smcinst
      - SmcService
      - SMTPSvc
      - SNAC
      - SntpService
      - Sophos
      - SQ1SafeOLRService
      - SQL Backups
      - SQL Server
      - SQLAgent
      - SQLANYs_Sage_FAS_Fixed_Assets
      - SQLBrowser
      - SQLsafe
      - SQLSERVERAGENT
      - SQLTELEMETRY
      - SQLWriter
      - SSISTELEMETRY130
      - SstpSvc
      - storflt
      - svcGenericHost
      - swc_service
      - swi_filter
      - swi_service
      - swi_update
      - Symantec
      - sysmon
      - TeamViewer
      - Telemetryserver
      - ThreatLockerService
      - TMBMServer
      - TmCCSF
      - TmFilter
      - TMiCRCScanService
      - tmlisten
      - TMLWCSService
      - TmPfw
      - TmPreFilter
      - TmProxy
      - TMSmartRelayService
      - tmusa
      - Tomcat
      - Trend Micro Deep Security Manager
      - TrueKey
      - UFNet
      - UI0Detect
      - UniFi
      - UTODetect
      - vds
      - Veeam
      - VeeamDeploySvc
      - Veritas System Recovery
      - vmic
      - VMTools
      - vmvss
      - VSApiNt
      - VSS
      - W3Svc
      - wbengine
      - WdNisSvc
      - WeanClOudSve
      - Weems JY
      - WinDefend
      - wmms
      - wozyprobackup
      - WPFFontCache_v0400
      - WRSVC
      - wsbexchange
      - WSearch
      - wscsvc
      - Zoolz 2 Service
  condition: all of selection_*
falsepositives:
  - Administrators or tools shutting down the services due to upgrade or removal purposes. If you experience some false positive, please consider adding filters to the parent process launching this command and not removing the entry
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL