Windows: Service stop activity via net.exe command line

Flags Windows processes running net.exe/net1.exe with a command line containing ' stop ' to stop a service.

FreeReviewedSigma · Low · v1

Product: windows
Category: process_creation
Author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2023-03-05
Updated: 2026-07-30

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1489Service Stop

What it detects

This rule matches process creation where the executed binary is net.exe (or net1.exe) and the command line contains the token ' stop '. Attackers can use built-in Windows utilities like net to stop services to disrupt availability or enable follow-on actions. Telemetry relies on process creation events that include the original file name and the full command line.

Reporting behind it

Related detections9 linkedT1489 — drag to rearrange

Possible Akira Ransomware VM Shutdown via vim-cmd

Possible Ransomware Pre-Encryption VM Termination via esxcli

Malicious Massive Processes Termination Burst (via process_creation)

Malicious Service Deactivation - Command (via process_creation)

Malicious ESXi Virtual Machine Termination and Snapshot Removal

Malicious Stopping of Security or Backup Services Before Impact (via process_creation)

Malicious Massive Services Deletion Burst (via process_creation)

Malicious Security Service Tampering via wmic PathName Query (via process_creation)

Suspicious GhostLocker Watchdog Process Execution (via process_creation)

Windows: Service stop activity via net.exe command line

Pivot detection · T1489 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-service-stop-activity-via-net-exe-command-line-88872991

title: "Windows: Service stop activity via net.exe command line"
id: c373860b-a0ff-4812-b844-a3eb5f237ed5
related:
  - id: eb87818d-db5d-49cc-a987-d5da331fbd90
    type: obsolete
  - id: 88872991-7445-4a22-90b2-a3adadb0e827
    type: derived
status: test
description: This rule matches process creation where the executed binary is net.exe (or net1.exe) and the command line contains the token ' stop '. Attackers can use built-in Windows utilities like net to stop services to disrupt availability or enable follow-on actions. Telemetry relies on process creation events that include the original file name and the full command line.
references:
  - https://ss64.com/nt/net-service.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_net_stop_service.yml
author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-05
tags:
  - attack.impact
  - attack.t1489
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - OriginalFileName:
        - net.exe
        - net1.exe
    - Image|endswith:
        - \net.exe
        - \net1.exe
  selection_cli:
    CommandLine|contains: " stop "
  condition: all of selection_*
falsepositives:
  - There are many legitimate reasons to stop a service. This rule isn't looking for any suspicious behaviour in particular. Filter legitimate activity accordingly
level: low
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL