Remote Service Stop via SMB

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects attempts to remotely stop a service via SMB (Server Message Block) by looking for the 'svcctl' and 'StopService' strings in TCP traffic on port 445. This activity is often associated with trojan activity or other malicious impact operations.