Skip to content

Hide Navigation Hide TOC

Suspicious Windows Service Tampering (ce72ef99-22f1-43d4-8695-419dcb5d9330)

Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts

Cluster A Galaxy A Cluster B Galaxy B Level
Disable or Modify Tools - T1562.001 (ac08589e-ee59-4935-8667-d845e38fe579) Attack Pattern Suspicious Windows Service Tampering (ce72ef99-22f1-43d4-8695-419dcb5d9330) Sigma-Rules 1
Suspicious Windows Service Tampering (ce72ef99-22f1-43d4-8695-419dcb5d9330) Sigma-Rules Service Stop - T1489 (20fb2507-d71c-455d-9b6d-6104461cf26b) Attack Pattern 1
Disable or Modify Tools - T1562.001 (ac08589e-ee59-4935-8667-d845e38fe579) Attack Pattern Impair Defenses - T1562 (3d333250-30e4-4a82-9edc-756c68afc529) Attack Pattern 2