Windows: Stop a Service with sc.exe via Process Creation (sc.exe stop)
Identifies sc.exe executions that include 'stop' to stop Windows services based on process creation and command line.
- Product
- windows
- Category
- process_creation
- Author
- Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-03-05
- Updated
- 2026-07-30
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where sc.exe is executed with command-line arguments containing ' stop ' to stop a Windows service. Stopping services can be used to disrupt availability or disable security/monitoring components. Detection relies on process creation telemetry capturing the executable name (OriginalFileName or an Image ending in \sc.exe) and the command line containing the stop operation.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Stop a Service with sc.exe via Process Creation (sc.exe stop)"
id: e7776ffd-441f-416d-8dc4-733ea2105212
related:
- id: eb87818d-db5d-49cc-a987-d5da331fbd90
type: obsolete
- id: 81bcb81b-5b1f-474b-b373-52c871aaa7b1
type: derived
status: test
description: This rule flags process creation events where sc.exe is executed with command-line arguments containing ' stop ' to stop a Windows service. Stopping services can be used to disrupt availability or disable security/monitoring components. Detection relies on process creation telemetry capturing the executable name (OriginalFileName or an Image ending in \sc.exe) and the command line containing the stop operation.
references:
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc742107(v=ws.11)
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sc_stop_service.yml
author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-05
modified: 2024-01-18
tags:
- attack.impact
- attack.t1489
logsource:
category: process_creation
product: windows
detection:
selection_img:
- OriginalFileName: sc.exe
- Image|endswith: \sc.exe
selection_cli:
CommandLine|contains: " stop "
condition: all of selection_*
falsepositives:
- There are many legitimate reasons to stop a service. This rule isn't looking for any suspicious behavior in particular. Filter legitimate activity accordingly
level: low
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_sc_stop_service/info.yml
license: DRL-1.1