Service Stop

let TargetedServices = dynamic([
  // Backup and recovery
  "vss", "VSS", "wbengine", "SDRSVC", "VeeamBackupSvc", "VeeamTransportSvc",
  "AcronisAgent", "BackupExecAgentAccelerator", "BackupExecAgentBrowser",
  "BackupExecDeviceMediaService", "BackupExecJobEngine", "BackupExecManagementService",
  "BackupExecRPCService", "SQLBackupMon",
  // Security / AV / EDR
  "WinDefend", "MsMpSvc", "SecurityHealthService", "Sense", "WdNisSvc",
  "CrowdStrike", "CSAgent", "CSFalconService", "McShield", "McTaskManager",
  "MfeEERM", "mfemms", "mfevtp", "SAVService", "SepMasterService",
  "Symantec", "SNAC", "TmCCSF", "SentinelAgent", "CarbonBlack",
  // Database and email
  "MSSQLSERVER", "MSSQL$", "SQLWriter", "SQLSERVERAGENT", "MsDtsServer",
  "ReportServer", "MSSQLFDLauncher", "MySQL", "OracleService",
  "MSExchangeIS", "MSExchangeTransport", "MSExchangeEdgeSync",
  "MSExchangeFDS", "MSExchangeMailboxAssistants", "MSExchangeRPC",
  "MSExchangeSA", "MSExchangeThrottling",
  // IT infrastructure
  "IISADMIN", "W3SVC", "WAS"
]);
let StopCommands = dynamic([
  "stop ", "config ", "delete ", "/stop", "/im"
]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("sc.exe", "net.exe", "net1.exe", "taskkill.exe", "powershell.exe", "pwsh.exe", "wmic.exe")
| where ProcessCommandLine has_any (TargetedServices)
    or (
        (FileName in~ ("sc.exe") and ProcessCommandLine has_any ("stop", "config", "delete"))
        or (FileName in~ ("net.exe", "net1.exe") and ProcessCommandLine has "stop")
        or (FileName in~ ("taskkill.exe") and ProcessCommandLine has "/f")
        or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("Stop-Service", "Set-Service", "sc.exe stop", "sc stop"))
        or (FileName in~ ("wmic.exe") and ProcessCommandLine has_any ("service", "call", "stopservice", "ChangeStartMode"))
    )
| extend StopMethod = case(
    FileName in~ ("sc.exe") and ProcessCommandLine has "stop", "sc stop",
    FileName in~ ("sc.exe") and ProcessCommandLine has "config" and ProcessCommandLine has "disabled", "sc disable",
    FileName in~ ("sc.exe") and ProcessCommandLine has "delete", "sc delete",
    FileName in~ ("net.exe", "net1.exe") and ProcessCommandLine has "stop", "net stop",
    FileName in~ ("taskkill.exe"), "taskkill",
    FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has "Stop-Service", "PowerShell Stop-Service",
    FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has "Set-Service", "PowerShell Set-Service",
    FileName in~ ("wmic.exe"), "WMIC service call",
    "other"
  )
| extend TargetsSecurityService = ProcessCommandLine has_any ("WinDefend", "MsMpSvc", "Sense", "CrowdStrike", "CSFalconService", "SentinelAgent", "CarbonBlack", "McShield", "SAVService", "SepMasterService", "WdNisSvc", "SecurityHealthService")
| extend TargetsBackupService = ProcessCommandLine has_any ("vss", "VSS", "wbengine", "VeeamBackupSvc", "SDRSVC", "BackupExec", "AcronisAgent", "SQLBackupMon")
| extend TargetsDatabaseService = ProcessCommandLine has_any ("MSSQLSERVER", "MySQL", "OracleService", "MSExchangeIS", "MSExchangeTransport", "SQLWriter")
| project Timestamp, DeviceName, AccountName, AccountDomain,
         FileName, ProcessCommandLine, InitiatingProcessFileName,
         InitiatingProcessCommandLine, InitiatingProcessParentFileName,
         StopMethod, TargetsSecurityService, TargetsBackupService, TargetsDatabaseService
| sort by Timestamp desc

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\sc.exe" OR Image="*\\net.exe" OR Image="*\\net1.exe" OR Image="*\\taskkill.exe"
   OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wmic.exe")
| eval cl=lower(CommandLine)
| eval StopMethod=case(
    match(Image, "sc\\.exe") AND match(cl, "\\bstop\\b"), "sc stop",
    match(Image, "sc\\.exe") AND match(cl, "config") AND match(cl, "disabled"), "sc disable",
    match(Image, "sc\\.exe") AND match(cl, "\\bdelete\\b"), "sc delete",
    match(Image, "net1?\\.exe") AND match(cl, "\\bstop\\b"), "net stop",
    match(Image, "taskkill\\.exe"), "taskkill",
    match(Image, "powers?hell\\.exe") AND match(cl, "stop-service"), "PS Stop-Service",
    match(Image, "powers?hell\\.exe") AND match(cl, "set-service"), "PS Set-Service",
    match(Image, "wmic\\.exe") AND match(cl, "service"), "WMIC service",
    1=1, "other"
  )
| eval TargetsSecurityService=if(match(cl, "(windefend|msmpeng|wdnissvc|sense|securityhealthservice|crowdstrike|csfalconservice|csfcsc|sentinelagent|carbonblack|mcshield|mcafee|savservice|sepmasterservice|symantec|trendmicro)")
    , 1, 0)
| eval TargetsBackupService=if(match(cl, "(vss|wbengine|sdrsvc|veea?mbackup|veea?mtransport|acronis|backupexec|sqlbackupmon|bedbg)"), 1, 0)
| eval TargetsDatabaseService=if(match(cl, "(mssqlserver|mssql\$|sqlwriter|sqlserveragent|mysql|oracleservice|msexchange)"), 1, 0)
| eval RiskScore=TargetsSecurityService*3 + TargetsBackupService*3 + TargetsDatabaseService*2
| where StopMethod != "other" OR RiskScore > 0
| eval IsHighRisk=if(RiskScore >= 3, "YES", "NO")
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine,
        StopMethod, TargetsSecurityService, TargetsBackupService, TargetsDatabaseService,
        RiskScore, IsHighRisk
| sort - RiskScore, - _time

sequence by host.id with maxspan=5m
  [process where event.type == "start" and
   process.name in~ ("sc.exe", "net.exe", "net1.exe", "taskkill.exe", "powershell.exe", "pwsh.exe", "wmic.exe") and
   (
     (process.name == "sc.exe" and process.args in~ ("stop", "config", "delete") and
       process.args in~ ("vss", "wbengine", "SDRSVC", "VeeamBackupSvc", "VeeamTransportSvc", "AcronisAgent", "BackupExecAgentAccelerator", "BackupExecJobEngine", "BackupExecManagementService", "SQLBackupMon", "WinDefend", "MsMpSvc", "SecurityHealthService", "Sense", "WdNisSvc", "CSFalconService", "SentinelAgent", "CarbonBlack", "McShield", "SAVService", "SepMasterService", "MSSQLSERVER", "SQLWriter", "MySQL", "OracleService", "MSExchangeIS", "MSExchangeTransport", "IISADMIN", "W3SVC"))
     or (process.name in~ ("net.exe", "net1.exe") and process.args == "stop")
     or (process.name == "taskkill.exe" and process.args : "/f")
     or (process.name in~ ("powershell.exe", "pwsh.exe") and process.command_line : ("*Stop-Service*", "*Set-Service*", "*sc stop*", "*sc.exe stop*"))
     or (process.name == "wmic.exe" and process.command_line : ("*service*call*stopservice*", "*ChangeStartMode*disabled*"))
   )
  ]

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  sourceip AS HostIP,
  devicehostname AS Hostname,
  username AS AccountName,
  "filename" AS ProcessName,
  "URL" AS CommandLine,
  CATEGORYNAME(category) AS EventCategory,
  CASE
    WHEN LOWER("URL") MATCHES '.*\\bsc\.exe.*\bstop\b.*' THEN 'sc stop'
    WHEN LOWER("URL") MATCHES '.*\\bsc\.exe.*\bconfig\b.*\bdisabled\b.*' THEN 'sc disable'
    WHEN LOWER("URL") MATCHES '.*\\bsc\.exe.*\bdelete\b.*' THEN 'sc delete'
    WHEN LOWER("URL") MATCHES '.*\\bnet1?\.exe.*\bstop\b.*' THEN 'net stop'
    WHEN LOWER("URL") MATCHES '.*\\btaskkill\.exe.*' THEN 'taskkill'
    WHEN LOWER("URL") MATCHES '.*\\bpowershell.*stop-service.*' THEN 'PS Stop-Service'
    WHEN LOWER("URL") MATCHES '.*\\bpowershell.*set-service.*' THEN 'PS Set-Service'
    WHEN LOWER("URL") MATCHES '.*\\bwmic\.exe.*service.*' THEN 'WMIC service'
    ELSE 'other'
  END AS StopMethod,
  CASE WHEN LOWER("URL") MATCHES '.*(windefend|msmpeng|wdnissvc|sense|securityhealthservice|crowdstrike|csfalconservice|sentinelagent|carbonblack|mcshield|savservice|sepmasterservice).*' THEN 1 ELSE 0 END AS TargetsSecurityService,
  CASE WHEN LOWER("URL") MATCHES '.*(vss|wbengine|sdrsvc|veeambackup|veeamtransport|acronis|backupexec|sqlbackupmon).*' THEN 1 ELSE 0 END AS TargetsBackupService,
  CASE WHEN LOWER("URL") MATCHES '.*(mssqlserver|mssql\$|sqlwriter|sqlserveragent|mysql|oracleservice|msexchange).*' THEN 1 ELSE 0 END AS TargetsDatabaseService
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND QIDNAME(qid) IN ('Process Create', 'A new process has been created')
  AND (
    LOWER("filename") IN ('sc.exe', 'net.exe', 'net1.exe', 'taskkill.exe', 'powershell.exe', 'pwsh.exe', 'wmic.exe')
  )
  AND (
    LOWER("URL") MATCHES '.*(vss|wbengine|sdrsvc|veeambackup|acronisagent|backupexec|sqlbackupmon|windefend|msmpeng|securityhealthservice|sense|wdnissvc|crowdstrike|csfalconservice|sentinelagent|carbonblack|mcshield|savservice|sepmasterservice|symantec|mssqlserver|sqlwriter|sqlserveragent|mysql|oracleservice|msexchangeis|msexchangetransport|iisadmin|w3svc).*'
    OR LOWER("URL") MATCHES '.*(sc\.exe|net\.exe|net1\.exe).*\bstop\b.*'
    OR LOWER("URL") MATCHES '.*taskkill.*\/f.*'
    OR LOWER("URL") MATCHES '.*powershell.*(stop-service|set-service).*'
    OR LOWER("URL") MATCHES '.*wmic.*service.*(stopservice|changestartmode).*'
  )
  AND starttime > NOW() - 86400 SECONDS
ORDER BY starttime DESC

_sourceCategory="windows/sysmon" OR _sourceCategory="windows/security"
| where EventID = "1" OR EventID = "4688"
| where Image matches "*\\sc.exe" OR Image matches "*\\net.exe" OR Image matches "*\\net1.exe"
  OR Image matches "*\\taskkill.exe" OR Image matches "*\\powershell.exe"
  OR Image matches "*\\pwsh.exe" OR Image matches "*\\wmic.exe"
| eval CommandLineLower = toLowerCase(CommandLine)
| where (
    (Image matches "*\\sc.exe" AND (CommandLineLower matches "*stop*" OR CommandLineLower matches "*config*disabled*" OR CommandLineLower matches "*delete*"))
    OR (Image matches "*\\net*.exe" AND CommandLineLower matches "*stop*")
    OR (Image matches "*\\taskkill.exe" AND CommandLineLower matches "*/f*")
    OR ((Image matches "*\\powershell.exe" OR Image matches "*\\pwsh.exe") AND (CommandLineLower matches "*stop-service*" OR CommandLineLower matches "*set-service*"))
    OR (Image matches "*\\wmic.exe" AND (CommandLineLower matches "*stopservice*" OR CommandLineLower matches "*changestartmode*disabled*"))
  )
| eval StopMethod = if(Image matches "*\\sc.exe" AND CommandLineLower matches "*stop*", "sc stop",
    if(Image matches "*\\sc.exe" AND CommandLineLower matches "*config*disabled*", "sc disable",
    if(Image matches "*\\sc.exe" AND CommandLineLower matches "*delete*", "sc delete",
    if(Image matches "*\\net*.exe" AND CommandLineLower matches "*stop*", "net stop",
    if(Image matches "*\\taskkill.exe", "taskkill",
    if((Image matches "*\\powershell.exe" OR Image matches "*\\pwsh.exe") AND CommandLineLower matches "*stop-service*", "PS Stop-Service",
    if((Image matches "*\\powershell.exe" OR Image matches "*\\pwsh.exe") AND CommandLineLower matches "*set-service*", "PS Set-Service",
    if(Image matches "*\\wmic.exe", "WMIC service", "other"))))))))
| eval TargetsSecurityService = if(CommandLineLower matches "*(windefend|msmpeng|wdnissvc|sense|securityhealthservice|crowdstrike|csfalconservice|sentinelagent|carbonblack|mcshield|savservice|sepmasterservice)*", 1, 0)
| eval TargetsBackupService = if(CommandLineLower matches "*(vss|wbengine|sdrsvc|veeambackup|veeamtransport|acronis|backupexec|sqlbackupmon)*", 1, 0)
| eval TargetsDatabaseService = if(CommandLineLower matches "*(mssqlserver|mssql$|sqlwriter|sqlserveragent|mysql|oracleservice|msexchange)*", 1, 0)
| eval RiskScore = (TargetsSecurityService * 3) + (TargetsBackupService * 3) + (TargetsDatabaseService * 2)
| where StopMethod != "other" OR RiskScore > 0
| eval IsHighRisk = if(RiskScore >= 3, "YES", "NO")
| fields _messageTime, Computer, User, Image, CommandLine, ParentImage, StopMethod,
    TargetsSecurityService, TargetsBackupService, TargetsDatabaseService, RiskScore, IsHighRisk
| sort by RiskScore desc, _messageTime desc

rule t1489_service_stop {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1489 Service Stop — adversaries stopping backup, security, or database services via sc.exe, net stop, taskkill, PowerShell, or WMIC"
    mitre_attack_tactic = "Impact"
    mitre_attack_technique = "T1489"
    severity = "HIGH"
    confidence = "HIGH"
    reference = "https://attack.mitre.org/techniques/T1489/"
    created = "2026-04-13"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.process.file.full_path = /(?i)(\\sc\.exe|\\net\.exe|\\net1\.exe|\\taskkill\.exe|\\powershell\.exe|\\pwsh\.exe|\\wmic\.exe)$/
    (
      (
        $e.principal.process.file.full_path = /(?i)\\sc\.exe$/ and
        $e.target.process.command_line = /(?i)\b(stop|config|delete)\b/
      ) or
      (
        $e.principal.process.file.full_path = /(?i)\\net1?\.exe$/ and
        $e.target.process.command_line = /(?i)\bstop\b/
      ) or
      (
        $e.principal.process.file.full_path = /(?i)\\taskkill\.exe$/ and
        $e.target.process.command_line = /(?i)\/f/
      ) or
      (
        $e.principal.process.file.full_path = /(?i)\\(powershell|pwsh)\.exe$/ and
        $e.target.process.command_line = /(?i)(Stop-Service|Set-Service|sc\.exe stop|sc stop)/
      ) or
      (
        $e.principal.process.file.full_path = /(?i)\\wmic\.exe$/ and
        $e.target.process.command_line = /(?i)(stopservice|ChangeStartMode.*disabled)/
      )
    )
    $e.target.process.command_line = /(?i)(vss|wbengine|sdrsvc|veeambackup|veeamtransport|acronisagent|backupexec|sqlbackupmon|windefend|msmpeng|securityhealthservice|sense|wdnissvc|crowdstrike|csfalconservice|sentinelagent|carbonblack|mcshield|savservice|sepmasterservice|symantec|mssqlserver|sqlwriter|sqlserveragent|mysql|oracleservice|msexchangeis|msexchangetransport|iisadmin|w3svc)/
    $hostname = $e.principal.hostname
    $user = $e.principal.user.userid
    $cmdline = $e.target.process.command_line

  condition:
    $e
}

#event_simpleName = ProcessRollup2
| FileName = /^(sc|net|net1|taskkill|powershell|pwsh|wmic)\.exe$/i
| CommandLine = /(?i)(vss|wbengine|sdrsvc|veeambackupsvc|veeamtransportsvc|acronisagent|backupexecagent|backupexecjobengine|sqlbackupmon|windefend|msmpeng|securityhealthservice|sense|wdnissvc|csfalconservice|crowdstrike|sentinelagent|carbonblack|mcshield|savservice|sepmasterservice|symantec|mssqlserver|sqlwriter|sqlserveragent|mysql|oracleservice|msexchangeis|msexchangetransport|iisadmin|w3svc)/
OR (
  FileName = /^sc\.exe$/i AND CommandLine = /(?i)\b(stop|config.*disabled|delete)\b/
)
OR (
  FileName = /^net1?\.exe$/i AND CommandLine = /(?i)\bstop\b/
)
OR (
  FileName = /^taskkill\.exe$/i AND CommandLine = /(?i)\/f/
)
OR (
  FileName = /^(powershell|pwsh)\.exe$/i AND CommandLine = /(?i)(stop-service|set-service|sc\.exe stop|sc stop)/
)
OR (
  FileName = /^wmic\.exe$/i AND CommandLine = /(?i)(stopservice|changestartmode.*disabled)/
)
| eval StopMethod = case(
    FileName = /^sc\.exe$/i AND CommandLine = /(?i)\bstop\b/, "sc stop",
    FileName = /^sc\.exe$/i AND CommandLine = /(?i)config.*disabled/, "sc disable",
    FileName = /^sc\.exe$/i AND CommandLine = /(?i)\bdelete\b/, "sc delete",
    FileName = /^net1?\.exe$/i AND CommandLine = /(?i)\bstop\b/, "net stop",
    FileName = /^taskkill\.exe$/i, "taskkill",
    FileName = /^(powershell|pwsh)\.exe$/i AND CommandLine = /(?i)stop-service/, "PS Stop-Service",
    FileName = /^(powershell|pwsh)\.exe$/i AND CommandLine = /(?i)set-service/, "PS Set-Service",
    FileName = /^wmic\.exe$/i, "WMIC service",
    "other"
  )
| eval TargetsSecurityService = if(CommandLine = /(?i)(windefend|msmpeng|wdnissvc|sense|securityhealthservice|csfalconservice|crowdstrike|sentinelagent|carbonblack|mcshield|savservice|sepmasterservice|symantec)/, 1, 0)
| eval TargetsBackupService = if(CommandLine = /(?i)(vss|wbengine|sdrsvc|veeambackup|acronis|backupexec|sqlbackupmon)/, 1, 0)
| eval TargetsDatabaseService = if(CommandLine = /(?i)(mssqlserver|mssql\$|sqlwriter|mysql|oracleservice|msexchange)/, 1, 0)
| eval RiskScore = TargetsSecurityService * 3 + TargetsBackupService * 3 + TargetsDatabaseService * 2
| where StopMethod != "other" OR RiskScore > 0
| eval IsHighRisk = if(RiskScore >= 3, "YES", "NO")
| groupBy([ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, StopMethod, TargetsSecurityService, TargetsBackupService, TargetsDatabaseService, RiskScore, IsHighRisk], function=([min(ContextTimeStamp_decimal, as=FirstSeen), max(ContextTimeStamp_decimal, as=LastSeen), count(as=EventCount)]))
| sort(RiskScore, order=desc)