Stop Windows Service Via Net.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects the stopping of a Windows service using the 'net.exe' or 'net1.exe' utility with the 'stop' command-line argument. This rule specifically looks for the execution of these utilities with the intent to terminate a service.