Windows: Stop a Service with sc.exe via Process Creation (sc.exe stop)

Identifies sc.exe executions that include 'stop' to stop Windows services based on process creation and command line.

FreeUnreviewedSigmalowv1

windows-stop-a-service-with-sc-exe-via-process-creation-sc-exe-stop-81bcb81b

title: "Windows: Stop a Service with sc.exe via Process Creation (sc.exe stop)"
id: e7776ffd-441f-416d-8dc4-733ea2105212
related:
  - id: eb87818d-db5d-49cc-a987-d5da331fbd90
    type: obsolete
  - id: 81bcb81b-5b1f-474b-b373-52c871aaa7b1
    type: derived
status: test
description: This rule flags process creation events where sc.exe is executed with command-line arguments containing ' stop ' to stop a Windows service. Stopping services can be used to disrupt availability or disable security/monitoring components. Detection relies on process creation telemetry capturing the executable name (OriginalFileName or an Image ending in \sc.exe) and the command line containing the stop operation.
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc742107(v=ws.11)
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sc_stop_service.yml
author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-05
modified: 2024-01-18
tags:
  - attack.impact
  - attack.t1489
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - OriginalFileName: sc.exe
    - Image|endswith: \sc.exe
  selection_cli:
    CommandLine|contains: " stop "
  condition: all of selection_*
falsepositives:
  - There are many legitimate reasons to stop a service. This rule isn't looking for any suspicious behavior in particular. Filter legitimate activity accordingly
level: low
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_sc_stop_service/info.yml
license: DRL-1.1

What it detects

This rule flags process creation events where sc.exe is executed with command-line arguments containing ' stop ' to stop a Windows service. Stopping services can be used to disrupt availability or disable security/monitoring components. Detection relies on process creation telemetry capturing the executable name (OriginalFileName or an Image ending in \sc.exe) and the command line containing the stop operation.

Known false positives

There are many legitimate reasons to stop a service. This rule isn't looking for any suspicious behavior in particular. Filter legitimate activity accordingly

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.