CmdID / PowerShell / Cmdlets / Set
Set-Service
Starts, stops, and suspends a service, and changes its properties. PowerShell reference
From the PowerShell reference 10 parameters 4 Sigma rules look for it
What it does
Starts, stops, and suspends a service, and changes its properties. The Set-Service cmdlet changes the properties of a service such as the Status, Description, DisplayName, and StartupType. Set-Service can start, stop, suspend, or pause a service. To identify a service, enter its service name or submit a service object. Or, send a service name or service object down the pipeline to Set-Service.
Set-Service [-ComputerName <String[]>] [-Name] <String> [-DisplayName <String>] [-Description <String>] [-StartupType <ServiceStartMode>] [-Status <String>] [-PassThru] [-WhatIf] [-Confirm] [<CommonParameters>]Set-Service [-ComputerName <String[]>] [-DisplayName <String>] [-Description <String>] [-StartupType <ServiceStartMode>] [-Status <String>] [-InputObject <ServiceController>] [-PassThru] [-WhatIf] [-Confirm] [<CommonParameters>]Change a display name
Set-Service -Name LanmanWorkstation -DisplayName "LanMan Workstation"IdentifyChange the startup type of services
Set-Service -Name BITS -StartupType Automatic
Get-Service BITS | Select-Object -Property Name, StartType, StatusIdentifyChange the description of a service
Get-CimInstance Win32_Service -Filter 'Name = "BITS"' | Format-List Name, DescriptionIdentifyStart a service
Set-Service -Name WinRM -Status Running -PassThruIdentifySuspend a service
Get-Service -Name Schedule | Set-Service -Status PausedIdentifyStop a service
$S = Get-Service -Name Schedule
Set-Service -InputObject $S -Status StoppedIdentifySet the startup type for multiple services
Get-Service SQLWriter,spooler |
Set-Service -StartupType Automatic -PassThru |
Select-Object Name, StartTypeIdentifyIts page in the reference: Set-Service.
Parameters
-ComputerNameSpecifies one or more computers. For remote computers, type the NetBIOS name, an IP address, or a fully qualified domain name. If the ComputerName parameter isn't specified, the command runs on the local computer.
This parameter doesn't rely on PowerShell remoting. You can use the ComputerName parameter even if your computer isn't configured to run remote commands.-DescriptionSpecifies a new description for the service.
The service description appears in Computer Management, Services. The Description isn't a
property of the Get-Service ServiceController object. To see the service description, use
Get-CimInstance that returns a Win32_Service object that represents the service.-DisplayNameSpecifies a new display name for the service.
NOTE: Typically, Set-Service only operates on Windows services and not drivers. However, if you specify the name of a driver, Set-Service can target the driver.-InputObjectSpecifies a ServiceController object that represents the service to change. Enter a variable
that contains the object, or type a command or expression that gets the object, such as a
Get-Service command. You can use the pipeline to send a service object to Set-Service.-NameSpecifies the service name of the service to be changed. Wildcard characters aren't permitted. You can use the pipeline to send a service name to Set-Service.
NOTE: Typically, Set-Service only operates on Windows services and not drivers. However, if you specify the name of a driver, Set-Service can target the driver.-PassThruReturns a ServiceController object that represents the services that were changed. By default,
Set-Service doesn't generate any output.-StartupTypeSets the startup type of the service. The acceptable values for this parameter are:
- Automatic - The service is started or was started by the operating system, at system start-up.
If an automatically started service depends on a manually started service, the manually started
service is also started automatically at system startup.
- Disabled - The service is disabled and cannot be started by a user or application.
- Manual - The service is started only manually, by a user, using the Service Control Manager,
or by an application.
- Boot - Indicates that the service is a device driver started by the system loader. This
value is valid only for device drivers.
- System - Indicates that the service is a device driver started by the 'IOInitSystem()'
function. This value is valid only for device drivers.
The default value is Automatic.-StatusSpecifies the status for the service.
The acceptable values for this parameter are as follows:
- Paused. Suspends the service.
- Running. Starts the service.
- Stopped. Stops the service.-ConfirmPrompts you for confirmation before running Set-Service.-WhatIfShows what would happen if Set-Service runs. The cmdlet isn't run.What looks for it
highAbuse of Service Permissions to Hide Services Via Set-ServiceNasreddine Bencherchali (Nextron Systems)
highSuspicious Service DACL Modification Via Set-Service CmdletNasreddine Bencherchali (Nextron Systems)
mediumService StartupType Change Via PowerShell Set-ServiceNasreddine Bencherchali (Nextron Systems)