Windows: Stop a Service with sc.exe via Process Creation (sc.exe stop)

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1489Service Stop

What it detects

This rule flags process creation events where sc.exe is executed with command-line arguments containing ' stop ' to stop a Windows service. Stopping services can be used to disrupt availability or disable security/monitoring components. Detection relies on process creation telemetry capturing the executable name (OriginalFileName or an Image ending in \sc.exe) and the command line containing the stop operation.

Reporting behind it

Related detections9 linkedT1489 — drag to rearrange

Possible Akira Ransomware VM Shutdown via vim-cmd

Possible Ransomware Pre-Encryption VM Termination via esxcli

Malicious Massive Processes Termination Burst (via process_creation)

Malicious Service Deactivation - Command (via process_creation)

Malicious ESXi Virtual Machine Termination and Snapshot Removal

Malicious Stopping of Security or Backup Services Before Impact (via process_creation)

Malicious Massive Services Deletion Burst (via process_creation)

Malicious Security Service Tampering via wmic PathName Query (via process_creation)

Suspicious GhostLocker Watchdog Process Execution (via process_creation)

Windows: Stop a Service with sc.exe via Process Creation (sc.exe stop)

Pivot detection · T1489 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-stop-a-service-with-sc-exe-via-process-creation-sc-exe-stop-81bcb81b

title: "Windows: Stop a Service with sc.exe via Process Creation (sc.exe stop)"
id: e7776ffd-441f-416d-8dc4-733ea2105212
related:
  - id: eb87818d-db5d-49cc-a987-d5da331fbd90
    type: obsolete
  - id: 81bcb81b-5b1f-474b-b373-52c871aaa7b1
    type: derived
status: test
description: This rule flags process creation events where sc.exe is executed with command-line arguments containing ' stop ' to stop a Windows service. Stopping services can be used to disrupt availability or disable security/monitoring components. Detection relies on process creation telemetry capturing the executable name (OriginalFileName or an Image ending in \sc.exe) and the command line containing the stop operation.
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc742107(v=ws.11)
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sc_stop_service.yml
author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-05
modified: 2024-01-18
tags:
  - attack.impact
  - attack.t1489
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - OriginalFileName: sc.exe
    - Image|endswith: \sc.exe
  selection_cli:
    CommandLine|contains: " stop "
  condition: all of selection_*
falsepositives:
  - There are many legitimate reasons to stop a service. This rule isn't looking for any suspicious behavior in particular. Filter legitimate activity accordingly
level: low
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_sc_stop_service/info.yml
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL