Service Started/Stopped Via Wmic.EXE

Title: Service Started/Stopped Via Wmic.EXE
Status: test
Description:Detects usage of wmic to start or stop a service
References:
  -https://sushant747.gitbooks.io/total-oscp-guide/content/privilege_escalation_windows.html
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-20
modified:2023-02-14
Tags:

• -'attack.execution'
• -'attack.t1047'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
OriginalFileName:'wmic.exe' Image|endswith:'\WMIC.exe'   selection_cli:
    CommandLine|contains|all:
      -' service '
      -' call '

    CommandLine|contains:
      -'stopservice'
      -'startservice'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: medium