Title:
Stop Windows Service Via Net.EXE
Status:
test
Description:Detects the stopping of a Windows service via the "net" utility.
References:
-https://ss64.com/nt/net-service.html
Author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-05
modified:None
Tags:
- -'attack.impact'
- -'attack.t1489'
Logsource:
- category: process_creation
- product: windows
Detection:
selection_img:
- OriginalFileName:
- 'net.exe'
- 'net1.exe'
- Image|endswith:
- '\net.exe'
- '\net1.exe'
selection_cli:
CommandLine|contains:
' stop '
condition:
all of selection_*
Falsepositives:
-There are many legitimate reasons to stop a service. This rule isn't looking for any suspicious behaviour in particular. Filter legitimate activity accordingly
Level:
low
