Stop Windows Service Via Sc.EXE

Title: Stop Windows Service Via Sc.EXE
Status: test
Description:Detects the stopping of a Windows service via the "sc.exe" utility
References:
  -https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc742107(v=ws.11)
Author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-05
modified:2024-01-18
Tags:

• -'attack.impact'
• -'attack.t1489'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
OriginalFileName:'sc.exe' Image|endswith:'\sc.exe'   selection_cli:
    CommandLine|contains: ' stop '
  condition:all of selection_*
Falsepositives:
  -There are many legitimate reasons to stop a service. This rule isn't looking for any suspicious behavior in particular. Filter legitimate activity accordingly
Level: low