Service Stop Commands (Sysmon)

id: '5367.8147'
title: Service Stop Commands
description: 'Adversaries may stop or disable services on a system to render those
  services unavailable to legitimate users. Stopping critical services can inhibit
  or stop response to an incident or aid in the adversary''s overall objectives to
  cause damage to the environment. Threat Actor Association: APT29/Nobelium/Cozy Bear,
  FIN6, Kimsuky, Lapsus$, Lazarus, TA2541, Traveling Spider - Software Association:
  BlackByte, Blackcat/ALPHV, Black Basta, Conti, Cring, Cuba, GhostShell, Lockbit,
  Nefilim, Prometheus / Spook, Ryuk, TeamTNT, WatchDog, WhisperGate, XingLocker --
  Atomics T1489 #Test1 Atomics T1489 #Test2 Atomics T1489 #Test3 -- #TrendingThreat
  #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ("EventID>1<" OR TERM(EventCode=1))
  ((TERM(sc.exe) OR TERM(sc) OR TERM(net) OR TERM(net.exe) ) AND TERM(stop) AND (TERM(ShellHWDetection)
  OR TERM(AVPSUS) OR TERM(McAfeeDLPAgentService) OR TERM(mfewc) OR TERM(eventlog)
  OR (TERM(BMR) AND TERM(SERVICE)))) OR ( TERM(taskkill) AND ( TERM(/IM) OR TERM(/PID)
  OR TERM(/T) ) AND TERM(/F)) OR ((TERM(sc.exe) OR TERM(sc)) AND TERM(CONFIG) AND
  TERM(START=) AND TERM(DISABLED)) | table _time, host, user event_id, parent_process,
  parent_process_id, parent_process_name, parent_process_path, process, process_current_directory,
  process_id, process_name, process_path, signature_id, user_id | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- defense-evasion:impair defenses:disable or modify tools
- impact:service stop
technique_id:
- T1562.001
- T1489
data_category:
- Process command-line parameters
- Windows Sysmon
references:
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lockergoga-ransomware-family-used-in-targeted-attacks/
- https://kcm.trellix.com/resources/sites/MCAFEE/content/live/CORP_KNOWLEDGEBASE/91000/KB91373/en_US/McAfee%20Labs%20Threat%20Advisory%20-%20LockerGoga.pdf