Stop Windows Service Via PowerShell Stop-Service

Title: Stop Windows Service Via PowerShell Stop-Service
Status: test
Description:Detects the stopping of a Windows service via the PowerShell Cmdlet "Stop-Service"
References:
  -https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/stop-service?view=powershell-7.4
Author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-05
modified:None
Tags:

• -'attack.impact'
• -'attack.t1489'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_sc_net_img:
    - OriginalFileName:
      - 'PowerShell.EXE'
      - 'pwsh.dll'
    - Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cli:
    CommandLine|contains: 'Stop-Service '
  condition:all of selection_*
Falsepositives:
  -There are many legitimate reasons to stop a service. This rule isn't looking for any suspicious behaviour in particular. Filter legitimate activity accordingly
Level: low