Stop Windows Service Via PowerShell Stop-Service
A Sigma rule for process creation on Windows, by Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems).
low 1 ATT&CK technique 2 programs it names 6 everyday examples trip it
What it looks for
detection:
selection_cli:
CommandLine|contains: 'Stop-Service '
selection_sc_net_img:
- OriginalFileName:
- 'PowerShell.EXE'
- 'pwsh.dll'
- Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
condition: all of selection_*
The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems), under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.
Command lines that trip it
Stop a service on the local computer on the page for stop-service
Stop-Service -Name service_nameIdentifyStop a service by using the display name on the page for stop-service
Stop-Service -DisplayName "name"IdentifyStop a service that has dependent services on the page for stop-service
Stop-Service -Name service_name -Force -ConfirmIdentifyAdd details to your tab completion values on the page for Register-ArgumentCompleter
$s = {
param(
$commandName,
$parameterName,
$wordToComplete,
$commandAst,
$fakeBoundParameters
)
$services = Get-Service | Where-Object {
$_.Status -eq 'Running' -and $_.Name -like "$wordToComplete*"
}
$services | ForEach-Object {
New-Object -Type System.Management.Automation.CompletionResult -ArgumentList @(
$_.Name # completionText
$_.Name # listItemText
'ParameterValue' # resultType
$_.Name # toolTip
)
}
}
Register-ArgumentCompleter -CommandName Stop-Service -ParameterName Name -ScriptBlock $sIdentifyStop a service on the local computer on the page for Stop-Service
Stop-Service -Name "sysmonlog"IdentifyStop a service that has dependent services on the page for Stop-Service
Get-Service -Name "iisadmin" | Format-List -Property Name, DependentServices
Stop-Service -Name "iisadmin" -Force -ConfirmIdentify