Windows - Service Stop (PowerShell)

id: '12724.31085'
title: Windows - Service Stop
description: 'This use case detects any service stop commands on Windows endpoints.
  Adversaries may stop or disable services on a system to render those services unavailable
  to legitimate users. Stopping critical services or processes can inhibit or stop
  response to an incident or aid in the adversary''s overall objectives to cause damage
  to the environment. Adversaries may accomplish this by disabling individual services
  of high importance to an organization, such as MSExchangeIS, which will make Exchange
  content inaccessible. In some cases, adversaries may stop or disable many or all
  services to render systems unusable. Services or processes may not allow for modification
  of their data stores while running. Adversaries may stop services or processes in
  order to conduct Data Destruction or Data Encrypted for Impact on the data stores
  of services like Exchange and SQL Server. -- Threat Actor Association: APT28 (aka.Fancy
  Bear, Fighting Ursa, Forest Blizzard, Pawn Storm, TA422, STRONTIUM), APT29/Nobelium/Cozy
  Bear, Cadet Blizzard, FIN6, GoldenJackal, Kimsuky, Lapsus$, Magic Hound (aka APT35,
  Charming Kitten, Phosphorus, and Mint Sandstorm) , TA2541, Traveling Spider - Software
  Association: AvosLocker, BianLian, BlackByte, Blackcat/ALPHV, Black Basta, Conti,
  Cring, Cuba, GhostShell, Hive, Lockbit, Nefilim, Prestige, Prometheus / Spook, Rhysida,
  Royal, Ryuk, Snatch, TeamTNT, Trigona, WatchDog, WhisperGate, XingLocker -- Atomics
  T1489 Test #1 Atomics T1489 Test #2 Atomics T1489 Test #3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") ((TERM(sc.exe) OR
  TERM(sc) OR TERM(net) OR TERM(net.exe)) AND TERM(stop)) OR ( TERM(taskkill) AND
  ( TERM(/IM) OR TERM(/PID) OR TERM(/T) ) AND TERM(/F)) OR ((TERM(sc.exe) OR TERM(sc))
  AND TERM(CONFIG) AND TERM(START=) AND TERM(DISABLED)) OR ((TERM(Stop-Process) OR
  TERM(kill) OR TERM(spps)) (TERM(-name) OR TERM(-ProcessName) OR TERM(-id))) OR (TERM(Win32_Process)
  AND ".terminate") | table _time, host, user parent_process*, process, process_*,
  signature_id, user_id | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:impair defenses:disable or modify tools
- impact:service stop
technique_id:
- T1562.001
- T1489
data_category:
- PowerShell logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1489/T1489.md#atomic-test-1---windows---stop-service-using-service-controller