Detection of Unauthorized Windows Service Termination

Adversaries often attempt to stop critical services on a Windows system to evade security controls, disable logging, or facilitate ransomware encryption. This activity is a common stage in campaigns like Prestige Ransomware, where attackers target security software to ensure their malicious payloads can execute without interference. By leveraging native Windows administration tools such as net.exe, sc.exe, or the PowerShell Stop-Service cmdlet, attackers can disrupt essential services, leading to potential data loss or system compromise. Defenders must monitor process creation events for these specific command-line patterns, as they often signal the preparation phase for more destructive impact or exfiltration activities.

Attack Chain

1. Initial access is established through means such as phishing or exploitation of remote services.
2. The adversary performs host discovery to identify security software and critical system management services.
3. A command-line interface (e.g., cmd.exe or powershell.exe) is spawned by the malicious actor or payload.
4. The adversary executes net stop [service_name] or sc stop [service_name] to terminate target services.
5. Alternatively, the adversary invokes the PowerShell cmdlet Stop-Service -Name [service_name] to achieve the same objective.
6. Security telemetry captures the process creation event detailing the utility, arguments, and parent process.
7. The target service is successfully stopped, leaving the system vulnerable to subsequent ransomware encryption or unauthorized data exfiltration.

Impact

Successful termination of security services blinds defenders and allows for the unimpeded execution of malware. Observed impacts include the deployment of ransomware which can lead to widespread system downtime, data loss, and significant operational disruption. This technique has been documented in various campaigns targeting infrastructure and endpoint systems across multiple sectors.

Recommendation

• Deploy the provided Sigma rule to your SIEM to monitor for suspicious service management commands.
• Enable Sysmon Event ID 1 or Windows Security Event ID 4688 to capture detailed process command-line arguments.
• Prioritize alerts involving service stops that originate from non-administrative processes or unusual parent process paths.
• Audit legitimate service restarts to tune out noise generated by automated system maintenance or software update processes.