CmdID / PowerShell / Cmdlets / Stop
Stop-Service
Stops one or more running services. PowerShell reference
From the PowerShell reference
10 parameters
Alias spsv
2 Sigma rules look for it
What it does
Stops one or more running services. The Stop-Service cmdlet sends a stop message to the Windows Service Controller for each of the specified services. You can specify the services by their service names or display names, or you can use the InputObject parameter to pass a service object that represents the service that you want to stop.
Stop-Service [-Force] [-NoWait] [-InputObject] <ServiceController[]> [-PassThru] [-Include <String[]>] [-Exclude <String[]>] [-WhatIf] [-Confirm] [<CommonParameters>]Stop-Service [-Force] [-NoWait] [-Name] <String[]> [-PassThru] [-Include <String[]>] [-Exclude <String[]>] [-WhatIf] [-Confirm] [<CommonParameters>]Stop-Service [-Force] [-NoWait] [-PassThru] -DisplayName <String[]> [-Include <String[]>] [-Exclude <String[]>] [-WhatIf] [-Confirm] [<CommonParameters>]Stop a service on the local computer
Stop-Service -Name "sysmonlog"IdentifyTrips 2 Sigma rules: highSuspicious Windows Service Tampering by Nasreddine Bencherchali (Nextron Systems), frack113 , X__Junior (Nextron Systems); lowStop Windows Service Via PowerShell Stop-Service by Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Stop a service by using the display name
Get-Service -DisplayName "telnet" | Stop-ServiceIdentifyStop a service that has dependent services
Get-Service -Name "iisadmin" | Format-List -Property Name, DependentServices
Stop-Service -Name "iisadmin" -Force -ConfirmIdentifyTrips 2 Sigma rules: highSuspicious Windows Service Tampering by Nasreddine Bencherchali (Nextron Systems), frack113 , X__Junior (Nextron Systems); lowStop Windows Service Via PowerShell Stop-Service by Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Its page in the reference: Stop-Service.
Parameters
-DisplayNameSpecifies the display names of the services to stop. Wildcard characters are permitted.-ExcludeSpecifies services that this cmdlet omits. The value of this parameter qualifies the Name parameter. Enter a name element or pattern, such as s*. Wildcard characters are permitted.-ForceForces the cmdlet to stop a service even if that service has dependent services.-IncludeSpecifies services that this cmdlet stops. The value of this parameter qualifies the Name parameter. Enter a name element or pattern, such as s*. Wildcard characters are permitted.-InputObjectSpecifies ServiceController objects that represent the services to stop. Enter a variable that contains the objects, or type a command or expression that gets the objects.-NameSpecifies the service names of the services to stop. Wildcard characters are permitted.-NoWaitIndicates that this cmdlet uses the no wait option.-PassThruReturns an object that represents the service. By default, this cmdlet does not generate any output.-ConfirmPrompts you for confirmation before running the cmdlet.-WhatIfShows what would happen if the cmdlet runs. The cmdlet is not run.