Windows: Service stop activity via net.exe command line

Flags Windows processes running net.exe/net1.exe with a command line containing ' stop ' to stop a service.

FreeUnreviewedSigmalowv1

windows-service-stop-activity-via-net-exe-command-line-88872991

title: "Windows: Service stop activity via net.exe command line"
id: c373860b-a0ff-4812-b844-a3eb5f237ed5
related:
  - id: eb87818d-db5d-49cc-a987-d5da331fbd90
    type: obsolete
  - id: 88872991-7445-4a22-90b2-a3adadb0e827
    type: derived
status: test
description: This rule matches process creation where the executed binary is net.exe (or net1.exe) and the command line contains the token ' stop '. Attackers can use built-in Windows utilities like net to stop services to disrupt availability or enable follow-on actions. Telemetry relies on process creation events that include the original file name and the full command line.
references:
  - https://ss64.com/nt/net-service.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_net_stop_service.yml
author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-05
tags:
  - attack.impact
  - attack.t1489
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - OriginalFileName:
        - net.exe
        - net1.exe
    - Image|endswith:
        - \net.exe
        - \net1.exe
  selection_cli:
    CommandLine|contains: " stop "
  condition: all of selection_*
falsepositives:
  - There are many legitimate reasons to stop a service. This rule isn't looking for any suspicious behaviour in particular. Filter legitimate activity accordingly
level: low
license: DRL-1.1

What it detects

This rule matches process creation where the executed binary is net.exe (or net1.exe) and the command line contains the token ' stop '. Attackers can use built-in Windows utilities like net to stop services to disrupt availability or enable follow-on actions. Telemetry relies on process creation events that include the original file name and the full command line.

Known false positives

There are many legitimate reasons to stop a service. This rule isn't looking for any suspicious behaviour in particular. Filter legitimate activity accordingly

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.