Suspicious Windows Service Tampering
Detects the usage of command-line tools such as 'net', 'sc', 'powershell', 'wmic', or 'psservice' to stop, pause, disable, or delete critical Windows services. This activity is often observed in ransomware attacks and other malicious campaigns aiming to evade defenses or cause impact by targeting security software, backup solutions, and other essential system services.
Sigma
