Skip to content
Threat Feed

Tag

Service-Disabled

1 brief RSS
high advisory

Windows Service Disabled Detection

Detection of a Windows service being disabled via Event ID 7040, a common tactic used by adversaries to evade defenses and maintain control over compromised systems.

Splunk Enterprise +2 defense-evasion service-disabled windows
2r 1t