T1489

Service Stop

Impact Last updated:

Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment. Adversaries commonly target backup services, security solutions (AV/EDR), database engines (SQL Server, Exchange, MySQL), and VSS to eliminate recovery options before deploying ransomware or wipers. Methods include sc.exe stop/config, net stop, PowerShell Stop-Service/Set-Service, taskkill against service host processes, and on ESXi, esxcli vm process kill.

What is T1489 Service Stop?

Service Stop (T1489) maps to the Impact tactic — the adversary is trying to manipulate, interrupt, or destroy your systems and data in MITRE ATT&CK.

This page provides production-ready detection logic for Service Stop, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated high severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Impact
Technique
T1489 Service Stop
Canonical reference
https://attack.mitre.org/techniques/T1489/
Microsoft Sentinel / Defender
kusto 
let TargetedServices = dynamic([
  // Backup and recovery
  "vss", "VSS", "wbengine", "SDRSVC", "VeeamBackupSvc", "VeeamTransportSvc",
  "AcronisAgent", "BackupExecAgentAccelerator", "BackupExecAgentBrowser",
  "BackupExecDeviceMediaService", "BackupExecJobEngine", "BackupExecManagementService",
  "BackupExecRPCService", "SQLBackupMon",
  // Security / AV / EDR
  "WinDefend", "MsMpSvc", "SecurityHealthService", "Sense", "WdNisSvc",
  "CrowdStrike", "CSAgent", "CSFalconService", "McShield", "McTaskManager",
  "MfeEERM", "mfemms", "mfevtp", "SAVService", "SepMasterService",
  "Symantec", "SNAC", "TmCCSF", "SentinelAgent", "CarbonBlack",
  // Database and email
  "MSSQLSERVER", "MSSQL$", "SQLWriter", "SQLSERVERAGENT", "MsDtsServer",
  "ReportServer", "MSSQLFDLauncher", "MySQL", "OracleService",
  "MSExchangeIS", "MSExchangeTransport", "MSExchangeEdgeSync",
  "MSExchangeFDS", "MSExchangeMailboxAssistants", "MSExchangeRPC",
  "MSExchangeSA", "MSExchangeThrottling",
  // IT infrastructure
  "IISADMIN", "W3SVC", "WAS"
]);
let StopCommands = dynamic([
  "stop ", "config ", "delete ", "/stop", "/im"
]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("sc.exe", "net.exe", "net1.exe", "taskkill.exe", "powershell.exe", "pwsh.exe", "wmic.exe")
| where ProcessCommandLine has_any (TargetedServices)
    or (
        (FileName in~ ("sc.exe") and ProcessCommandLine has_any ("stop", "config", "delete"))
        or (FileName in~ ("net.exe", "net1.exe") and ProcessCommandLine has "stop")
        or (FileName in~ ("taskkill.exe") and ProcessCommandLine has "/f")
        or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("Stop-Service", "Set-Service", "sc.exe stop", "sc stop"))
        or (FileName in~ ("wmic.exe") and ProcessCommandLine has_any ("service", "call", "stopservice", "ChangeStartMode"))
    )
| extend StopMethod = case(
    FileName in~ ("sc.exe") and ProcessCommandLine has "stop", "sc stop",
    FileName in~ ("sc.exe") and ProcessCommandLine has "config" and ProcessCommandLine has "disabled", "sc disable",
    FileName in~ ("sc.exe") and ProcessCommandLine has "delete", "sc delete",
    FileName in~ ("net.exe", "net1.exe") and ProcessCommandLine has "stop", "net stop",
    FileName in~ ("taskkill.exe"), "taskkill",
    FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has "Stop-Service", "PowerShell Stop-Service",
    FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has "Set-Service", "PowerShell Set-Service",
    FileName in~ ("wmic.exe"), "WMIC service call",
    "other"
  )
| extend TargetsSecurityService = ProcessCommandLine has_any ("WinDefend", "MsMpSvc", "Sense", "CrowdStrike", "CSFalconService", "SentinelAgent", "CarbonBlack", "McShield", "SAVService", "SepMasterService", "WdNisSvc", "SecurityHealthService")
| extend TargetsBackupService = ProcessCommandLine has_any ("vss", "VSS", "wbengine", "VeeamBackupSvc", "SDRSVC", "BackupExec", "AcronisAgent", "SQLBackupMon")
| extend TargetsDatabaseService = ProcessCommandLine has_any ("MSSQLSERVER", "MySQL", "OracleService", "MSExchangeIS", "MSExchangeTransport", "SQLWriter")
| project Timestamp, DeviceName, AccountName, AccountDomain,
         FileName, ProcessCommandLine, InitiatingProcessFileName,
         InitiatingProcessCommandLine, InitiatingProcessParentFileName,
         StopMethod, TargetsSecurityService, TargetsBackupService, TargetsDatabaseService
| sort by Timestamp desc

Detects service stop and disable activity targeting backup, security, database, and email services commonly killed by ransomware and wipers prior to encryption or destruction. Uses DeviceProcessEvents to monitor sc.exe, net.exe, net1.exe, taskkill.exe, powershell.exe, and wmic.exe for stop/disable/delete commands against a list of high-value service names. Enriches each event with flags indicating whether the targeted service is a security solution, backup service, or database engine to aid analyst triage.

high severity high confidence

Data Sources

Process: Process Creation Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives

  • System administrators performing legitimate service maintenance, patch cycles, or decommissioning of services via sc.exe or net stop
  • IT automation platforms (Ansible, Chef, Puppet, SCCM) stopping services before updates or configuration changes
  • Backup software agents that stop VSS or database services as part of a legitimate quiesced backup procedure
  • Monitoring and patch management tools that restart services during scheduled maintenance windows
  • Development and QA environments where engineers frequently stop and restart database or web services during testing

Sigma rule & cross-platform mapping

The detection logic for Service Stop (T1489) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1489 Sigma rules on detection.fyi

Platform-specific guides for T1489

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-13 Research depth: deep
References (9)

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Stop Windows Defender Service via sc.exe

    Expected signal: Sysmon Event ID 1: Process Create with Image=sc.exe, CommandLine='sc.exe stop WinDefend' and 'sc.exe config WinDefend start= disabled'. Security Event ID 4688 (if process creation auditing enabled). System Event ID 7040 (if the config change succeeds: start type changed). System Event ID 7036 (if stop succeeds: service entered stopped state).

  2. Test 2Bulk Service Stop via net.exe (Ransomware Simulation)

    Expected signal: Sysmon Event ID 1: Six separate process creation events for net.exe with stop commands. System Event ID 7036 for any services that were actually running and stopped. The rapid sequence of 6 net.exe executions within seconds triggers the bulk stop hunting query.

  3. Test 3Stop and Disable Service via PowerShell Stop-Service

    Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Stop-Service' and 'wbengine'. PowerShell ScriptBlock Log Event ID 4104 with the full command. System Event ID 7036 (if service stopped) and 7040 (if startup type changed to Disabled).

  4. Test 4WMIC Service Stop via WMI

    Expected signal: Sysmon Event ID 1: Process Create with Image=wmic.exe, CommandLine containing 'service', 'StopService'. System Event ID 7036 (Windows Event Log service entered stopped state). Note: stopping EventLog will briefly interrupt event logging — telemetry for the stop itself is captured by Sysmon before EventLog stops.

  5. Test 5Disable Service by Modifying Registry Start Value

    Expected signal: Sysmon Event ID 13 (Registry Value Set): TargetObject=HKLM\SYSTEM\CurrentControlSet\Services\wbengine\Start, Details=DWORD (0x00000004). Sysmon Event ID 1: Process Create for reg.exe. Note: this test validates the registry-based hunting path and demonstrates that service disablement can occur without sc.exe or net.exe being called.

Response Playbook

Triage

  1. Identify which service(s) were stopped — determine if the target is a security tool (AV/EDR), backup service (VSS, Veeam, Windows Backup), database (MSSQL, Exchange, MySQL), or other critical infrastructure service. This classification determines the likely attacker intent.
  2. Examine the initiating process — was sc.exe or net.exe launched by a legitimate admin tool, a script, an unexpected parent (cmd.exe from Word/Excel, wscript.exe, mshta.exe), or a service running as SYSTEM? Parent process context is the strongest signal for legitimacy.
  3. Check user context and account type — is this a domain admin, a service account, or a standard user? A standard user stopping WinDefend or VSS is near-certain malicious activity. Cross-check against Active Directory for the account's typical role.
  4. Look for bulk service stop activity — query the last 60 minutes for sc.exe or net.exe executions on the same host. Ransomware typically stops 10-50+ services in rapid succession (within seconds). If you see a sequence of stops across backup + security + database categories, treat this as a ransomware pre-encryption stage.
  5. Correlate with shadow copy deletion — check for vssadmin.exe, wmic.exe, or PowerShell commands that delete shadow copies (vssadmin delete shadows, wmic shadowcopy delete). This combination with service stops is the canonical ransomware preparation sequence.
  6. Check for concurrent file system activity — if service stops are followed immediately by high-volume file creation or rename events (especially to unusual extensions like .locked, .encrypted, .clop, .blackcat), this is an active ransomware incident requiring immediate containment.

Containment

  1. If ransomware activity is confirmed or strongly suspected: immediately isolate the endpoint using EDR network isolation (CrowdStrike RTR, Defender for Endpoint isolate device) to prevent lateral spread. Do NOT simply reboot — this may destroy volatile forensic evidence.
  2. If a security service (WinDefend, CrowdStrike, SentinelOne) was successfully stopped: assume the endpoint is now unprotected. Treat it as fully compromised and escalate to full IR. Isolate immediately and do not reconnect until re-imaged.
  3. Disable the compromised account used to execute service stop commands: disable in Active Directory, revoke Kerberos tickets (klist purge on the host), revoke OAuth/SAML tokens if cloud SSO is in use.
  4. If VSS/backup services were stopped and shadow copies may have been deleted: immediately snapshot any surviving VM infrastructure at the hypervisor layer before any further investigation activity overwrites data.
  5. If database services (MSSQLSERVER, Exchange) were stopped: notify database administrators to assess data integrity before attempting a restart — restarting into a partially encrypted state may compound damage.
  6. Block the parent process or script that triggered the service stops at the EDR level and across other endpoints using IOC hash-based blocking.

Evidence Collection

  1. Process Creation Events — Sysmon Event ID 1 or Security Event ID 4688 (with command line auditing enabled): capture the full command lines, parent/grandparent process chain, timestamps, and user context for all service stop commands
  2. Windows Event Log: System (Event ID 7036 — Service changed to stopped state, Event ID 7040 — Service start type changed): these are generated by the Service Control Manager when services actually stop, confirming the stop command succeeded
  3. Windows Event Log: Security (Event ID 4656, 4663 — object access to Service Control Manager): if auditing is enabled on the SCM, captures which account accessed service control objects
  4. Sysmon Event ID 13 (Registry Value Set): capture any modifications to HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName>\Start (value 4 = disabled) as evidence of service disablement via registry
  5. Prefetch files: C:\Windows\Prefetch\SC.EXE-*.pf, NET.EXE-*.pf, TASKKILL.EXE-*.pf — contain execution timestamps and a list of files loaded, useful for confirming execution order during IR timeline reconstruction
  6. Memory acquisition (if endpoint is still live): a full memory dump via winpmem or EDR-based memory collection may contain ransomware binary artefacts, decryption keys (before they are destroyed), and the full process tree of the attack
  7. Volume Shadow Copy status: run 'vssadmin list shadows' to determine if shadow copies survive. If they are absent and the system had VSS enabled, this is evidence of intentional deletion as part of the attack chain
  8. Scheduled tasks and services: run 'schtasks /query /fo LIST /v' and 'sc query type= all state= all' to identify any attacker-created persistence mechanisms installed before or after the service stop activity

Escalation Criteria

  • ! Bulk service stop: 5 or more service stop commands within 2 minutes on the same host — this is the hallmark pre-encryption phase of ransomware and requires immediate P1 incident response
  • ! Security service targeted: any successful stop of WinDefend, CrowdStrike Falcon, SentinelOne, Carbon Black, or equivalent EDR/AV — the endpoint is now functionally unprotected and must be treated as fully compromised
  • ! VSS and backup services stopped in combination with ransomware-associated indicators (high file modification rate, shadow copy deletion, ransom note file creation) — active ransomware deployment in progress
  • ! Service stop initiated by a non-administrative user account or a service account that has no business justification for service management — credential theft or privilege escalation likely preceded this action
  • ! Lateral spread evidence: the same sc.exe stop pattern appearing on multiple hosts within a short time window — automated ransomware propagation in progress, requiring network segmentation

Investigation Guide

Forensic Artifacts

  • > Windows Event Log — System: Event ID 7036 (Service Control Manager: The <service> service entered the stopped state) and Event ID 7040 (start type changed from auto to disabled) — these are ground truth that the stop succeeded
  • > Registry: HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName>\Start — value of 4 indicates the service was disabled; check LastWrite time for when the change was made
  • > Registry: HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName>\ImagePath — verify the binary path was not modified by the attacker before stopping the service
  • > Prefetch: C:\Windows\Prefetch\SC.EXE-*.pf, NET.EXE-*.pf — execution count and last run timestamps; high execution counts in a short window confirm bulk service stop activity
  • > Shimcache / AppCompatCache (HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache): records sc.exe, net.exe execution metadata even without process auditing enabled
  • > Amcache.hve (C:\Windows\AppCompat\Programs\Amcache.hve): records file hash and first execution time of sc.exe, net.exe, taskkill.exe, useful for timeline correlation
  • > VSS Shadow Copy inventory: output of 'vssadmin list shadows' — absent shadows on a system where VSS was previously enabled is strong evidence of attacker cleanup
  • > File system: ransom note files (README.txt, HOW_TO_DECRYPT.txt, DECRYPT_FILES.html) appearing shortly after service stop timestamps anchor the full attack timeline

Tuning Guidance

The most effective approach is to build an allowlist of legitimate parent process and initiating account combinations. Common benign patterns include: SCCM/ConfigMgr stopping services during software installation (parent: CcmExec.exe or msiexec.exe), backup agents stopping VSS before quiesced snapshots (parent: VeeamAgent.exe, beremote.exe), patch management tools stopping services during patching cycles (parent: TrustedInstaller.exe, msiexec.exe). Tuning should be targeted at the _combination_ of parent + service name, not broad exclusions. Never exclude the pattern of stopping WinDefend or CrowdStrike from a non-standard parent — this combination has essentially no legitimate use outside of EDR vendor tooling. For environments with high-volume automation, add a threshold: alert only when >= 3 distinct services are stopped within 10 minutes, while logging all individual stops for the SIEM. Correlating with System Event ID 7036 (service entered stopped state) is strongly recommended to eliminate false positives from failed stop attempts (e.g., a user trying to stop a protected service). Also consider excluding well-known maintenance accounts with change management tickets by joining against your CMDB or enriching with ServiceNow integration — a stop during a scheduled maintenance window is benign; the same stop at 2am on a weekend warrants immediate triage.

Hunting Queries

Hunt for bulk service stop activity — 5 or more stop/disable/delete commands within a 5-minute window on the same host. This pattern is characteristic of ransomware pre-encryption preparation and differs from the per-service detection by focusing on temporal density across all service types rather than specific target names.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("sc.exe", "net.exe", "net1.exe")
| where ProcessCommandLine has "stop" or ProcessCommandLine has "config" or ProcessCommandLine has "delete"
| summarize ServiceStopCount=count(),
           FirstStop=min(Timestamp),
           LastStop=max(Timestamp),
           ServicesTargeted=make_set(ProcessCommandLine),
           UniqueAccounts=dcount(AccountName)
    by DeviceName, bin(Timestamp, 5m)
| where ServiceStopCount >= 5
| extend AttackWindowSeconds=datetime_diff('second', LastStop, FirstStop)
| sort by ServiceStopCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\sc.exe" OR Image="*\\net.exe" OR Image="*\\net1.exe")
  (CommandLine="* stop *" OR CommandLine="* config *" OR CommandLine="* delete *")
| bin _time span=5m
| stats count as ServiceStopCount,
        earliest(_time) as FirstStop,
        latest(_time) as LastStop,
        values(CommandLine) as ServicesTargeted,
        dc(User) as UniqueAccounts
  by host, _time
| where ServiceStopCount >= 5
| eval AttackWindowSeconds=LastStop - FirstStop
| sort - ServiceStopCount

Hunt for the ransomware preparation sequence: service stop commands followed by shadow copy deletion (or vice versa) within the same 30-minute window on the same host. This two-event correlation is one of the highest-fidelity indicators of active ransomware deployment and requires immediate response.

Hunting — KQL
kql 
let ServiceStops = DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("sc.exe", "net.exe", "net1.exe", "taskkill.exe", "powershell.exe")
| where ProcessCommandLine has_any ("stop", "Stop-Service", "/f /im")
| project StopTime=Timestamp, DeviceName, AccountName, StopCmd=ProcessCommandLine;
let ShadowDelete = DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("vssadmin.exe", "wmic.exe", "powershell.exe")
| where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "Delete-ComputerSnapshot")
| project DeleteTime=Timestamp, DeviceName, DeleteCmd=ProcessCommandLine;
ServiceStops
| join kind=inner ShadowDelete on DeviceName
| where abs(datetime_diff('minute', StopTime, DeleteTime)) <= 30
| project DeviceName, AccountName, StopTime, StopCmd, DeleteTime, DeleteCmd
| sort by StopTime desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  ((Image="*\\sc.exe" OR Image="*\\net.exe" OR Image="*\\net1.exe") (CommandLine="* stop *"))
  OR
  ((Image="*\\vssadmin.exe" OR Image="*\\wmic.exe") (CommandLine="*delete shadows*" OR CommandLine="*shadowcopy delete*"))
| eval EventType=case(
    match(Image, "vssadmin") OR (match(Image, "wmic") AND match(lower(CommandLine), "shadow")), "ShadowDelete",
    1=1, "ServiceStop"
  )
| transaction host maxspan=30m
| search EventType="ShadowDelete" AND EventType="ServiceStop"
| table _time, host, User, CommandLine, EventType
| sort - _time

Hunt specifically for stop/disable commands targeting named security products (Windows Defender, CrowdStrike, SentinelOne, Carbon Black, McAfee, Symantec, etc.). This is a defense evasion-focused hunt that finds cases where the attacker is specifically targeting the security stack rather than doing bulk service stops, which may indicate a more targeted intrusion versus commodity ransomware.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("sc.exe", "net.exe", "net1.exe")
| where ProcessCommandLine has_any ("WinDefend", "MsMpSvc", "wdnissvc", "Sense", "SecurityHealthService",
         "CSFalconService", "CrowdStrike", "SentinelAgent", "SentinelOne",
         "CarbonBlack", "cbdefense", "McShield", "McAfee", "SAVService",
         "SepMasterService", "Symantec", "TmCCSF", "FireEye")
| where ProcessCommandLine has_any ("stop", "config", "delete")
| project Timestamp, DeviceName, AccountName, AccountDomain,
         ProcessCommandLine, InitiatingProcessFileName,
         InitiatingProcessCommandLine, InitiatingProcessParentFileName
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\sc.exe" OR Image="*\\net.exe" OR Image="*\\net1.exe")
  (CommandLine="* stop *" OR CommandLine="* config *" OR CommandLine="* delete *")
  (CommandLine="*windefend*" OR CommandLine="*msmpeng*" OR CommandLine="*sense*"
   OR CommandLine="*csfalconservice*" OR CommandLine="*crowdstrike*"
   OR CommandLine="*sentinelagent*" OR CommandLine="*carbonblack*"
   OR CommandLine="*mcshield*" OR CommandLine="*savservice*"
   OR CommandLine="*sepmasterservice*" OR CommandLine="*trendmicro*" OR CommandLine="*fireeye*")
| table _time, host, User, CommandLine, ParentImage, ParentCommandLine
| sort - _time

Atomic Red Team Tests

Test 1 Stop Windows Defender Service via sc.exe
windows

Simulates a ransomware operator disabling the Windows Defender service using sc.exe, the native Windows Service Control utility. WannaCry, Clop, and many other ransomware families target WinDefend as their first service stop action to eliminate real-time malware detection before deploying their encryption payload. Note: this will likely fail on modern Windows 10/11 due to Protected Process Light (PPL) protecting WinDefend — the attempt still generates the process creation and SCM error events used by the detection.

Command

powershell 
sc.exe stop WinDefend
sc.exe config WinDefend start= disabled

Cleanup

powershell 
sc.exe config WinDefend start= auto
sc.exe start WinDefend

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=sc.exe, CommandLine='sc.exe stop WinDefend' and 'sc.exe config WinDefend start= disabled'. Security Event ID 4688 (if process creation auditing enabled). System Event ID 7040 (if the config change succeeds: start type changed). System Event ID 7036 (if stop succeeds: service entered stopped state).

Expected Detection

KQL alert: FileName=sc.exe with ProcessCommandLine containing 'WinDefend' and 'stop'. TargetsSecurityService=true. SPL alert: StopMethod='sc stop', TargetsSecurityService=1, RiskScore=3, IsHighRisk=YES.

Test 2 Bulk Service Stop via net.exe (Ransomware Simulation)
windows

Executes a sequence of net stop commands against backup, database, and service process targets commonly terminated by ransomware families including Prestige, WannaCry, and Clop. This simulates the pre-encryption preparation phase where services are stopped to release file locks on data stores (Exchange databases, SQL MDF files, VSS snapshots). Services listed here are chosen for low operational risk — most will simply return 'service is not started' if not running, which still generates the detection event.

Command

powershell 
net stop MSSQLSERVER /y
net stop "SQL Server (MSSQLSERVER)" /y
net stop MSExchangeIS /y
net stop wbengine /y
net stop SDRSVC /y
net stop VSS /y

Cleanup

powershell 
net start VSS
net start SDRSVC

Expected Telemetry

Sysmon Event ID 1: Six separate process creation events for net.exe with stop commands. System Event ID 7036 for any services that were actually running and stopped. The rapid sequence of 6 net.exe executions within seconds triggers the bulk stop hunting query.

Expected Detection

KQL main detection: multiple events with FileName=net.exe, ProcessCommandLine containing service names in TargetedServices list. Bulk service stop hunting query: ServiceStopCount >= 5 within a 5-minute bin fires. SPL: TargetsDatabaseService=1 and TargetsBackupService=1 across events, RiskScore >= 5.

Test 3 Stop and Disable Service via PowerShell Stop-Service
windows

Uses PowerShell's Stop-Service and Set-Service cmdlets to stop and disable the Windows Backup service (wbengine). PowerShell-based service stop is used by Olympic Destroyer (which used ChangeServiceConfigW API) and many fileless ransomware variants that execute entirely from memory. This test generates PowerShell-specific telemetry distinct from sc.exe/net.exe and validates that the detection catches the PowerShell execution path.

Command

powershell 
powershell.exe -Command "Stop-Service -Name wbengine -Force -ErrorAction SilentlyContinue; Set-Service -Name wbengine -StartupType Disabled"

Cleanup

powershell 
powershell.exe -Command "Set-Service -Name wbengine -StartupType Manual; Start-Service -Name wbengine -ErrorAction SilentlyContinue"

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Stop-Service' and 'wbengine'. PowerShell ScriptBlock Log Event ID 4104 with the full command. System Event ID 7036 (if service stopped) and 7040 (if startup type changed to Disabled).

Expected Detection

KQL alert: FileName=powershell.exe, StopMethod='PowerShell Stop-Service', ProcessCommandLine contains 'wbengine'. TargetsBackupService=true. SPL: StopMethod='PS Stop-Service', TargetsBackupService=1, RiskScore=3.

Test 4 WMIC Service Stop via WMI
windows

Uses wmic.exe to invoke the StopService method on the Windows Event Log service via WMI. WMIC-based service control is used by sophisticated threat actors and some ransomware variants as an alternative to sc.exe that may evade simpler process-name-only detections. This test validates coverage of the WMIC execution path in the detection.

Command

powershell 
wmic service where "Name='EventLog'" call StopService

Cleanup

powershell 
net start EventLog

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=wmic.exe, CommandLine containing 'service', 'StopService'. System Event ID 7036 (Windows Event Log service entered stopped state). Note: stopping EventLog will briefly interrupt event logging — telemetry for the stop itself is captured by Sysmon before EventLog stops.

Expected Detection

KQL alert: FileName=wmic.exe, StopMethod='WMIC service call', ProcessCommandLine contains 'service' and 'StopService'. SPL: StopMethod='WMIC service', the command is visible in the Sysmon process creation log.

Test 5 Disable Service by Modifying Registry Start Value
windows

Directly modifies the service Start registry value to 4 (disabled) to disable the Windows Backup service without calling sc.exe or net.exe. This technique is used by sophisticated actors to disable services in a way that evades process-based detections that only look for sc.exe/net.exe. Olympic Destroyer used ChangeServiceConfigW API calls at a lower level; this test simulates the registry outcome of that operation.

Command

powershell 
reg add "HKLM\SYSTEM\CurrentControlSet\Services\wbengine" /v Start /t REG_DWORD /d 4 /f

Cleanup

powershell 
reg add "HKLM\SYSTEM\CurrentControlSet\Services\wbengine" /v Start /t REG_DWORD /d 3 /f

Expected Telemetry

Sysmon Event ID 13 (Registry Value Set): TargetObject=HKLM\SYSTEM\CurrentControlSet\Services\wbengine\Start, Details=DWORD (0x00000004). Sysmon Event ID 1: Process Create for reg.exe. Note: this test validates the registry-based hunting path and demonstrates that service disablement can occur without sc.exe or net.exe being called.

Expected Detection

This test bypasses the primary process-based detection (by design — demonstrates a gap). The Sysmon Registry hunting query should catch this: filter for EventCode=13, TargetObject matching Services\*\Start, Details=0x4. This validates a registry-based secondary detection layer should be added to complement the process-based detection for advanced threat coverage.

Related Detections

Tactic Hub

TA0040Impact

Detection Variants (3)

Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.

Related Techniques

T1485Data DestructionT1486Data Encrypted for ImpactT1490Inhibit System RecoveryT1562.001Disable or Modify ToolsT1562.004Disable or Modify System FirewallT1059.001PowerShellT1059.003Windows Command ShellT1047Windows Management InstrumentationT1543.003Windows ServiceT1078Valid Accounts

Same Tactic: Impact

Popular Detections