Ransomware mass stop of backup, database and security services
Detects pre-encryption behaviors where an adversary or script stops or disables multiple critical services (such as backup solutions, databases, and security software) using standard Windows utilities (sc.exe, net.exe, taskkill.exe, powershell.exe) in a short timeframe, commonly observed prior to ransomware deployment.
Microsoft Sentinel (KQL)
