Stop Windows Service Via PowerShell Stop-Service

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects the stopping of a Windows service via the PowerShell Cmdlet "Stop-Service". This rule identifies PowerShell processes executing the 'Stop-Service' command, which can be used by adversaries to disrupt services, inhibit incident response, or facilitate data destruction or encryption for impact.