Query: write Sigma for Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or
Matching passage: Sigma rule: Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or. Logsource: windows / process_creation. Rule: title: Suspicious Windows Service Tampering id: ce72ef99-22f1-43d4-8695-419dcb5d9330 related: - id: eb87818d-db5d-49cc-a987-d5da331fbd90 type: obsolete - id: 6783aa9e-0dc3-49d4-a94a-8b39c5fd700b type: obsolete - id: 7fd4bb39-12d0-45ab-bb36-cebabc73dc7b type: obsolete status: test description: 'Detects the usage of binaries such as ''net'', ''sc'' or ''powershell'' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts ' references: - https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus/Genshin%20Impact%20Figure%2010.jpg - https://www.trellix.com/en-sg/about/newsroom/stories/threat-labs/lockergoga-ransomware-family-used-in-targeted-attacks.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/ - https://www.virustotal.com/gui/file/38283b775552da8981452941ea74191aa0d203edd3f61fb2dee7b0aea3514955 - https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/delete-method-in-class-win32-service author: Nasreddine Bencherchali (Nextron Systems), frack113 , X__Junior (Nextron Systems) date: 2022-09-01 modified: 2025-08-27 tags: - attack.impact - attack.defense-impairment - attack.t1489 - attack.t1685 logsource: category: process_creation product: windows detection: selection_tools_img: - OriginalFileName: - net.exe - net1.exe - PowerShell_ISE.EXE - PowerShell.EXE - psservice.exe - pwsh.dll - sc.exe - wmic.exe - Image|endswith: - \net.exe - \net1.exe - \PowerShell_ISE.EXE - \powershell.exe - \PsService.exe - \PsService64.exe - \pwsh.exe - \sc.exe - \wmic.exe selection_tools_cli: - CommandLine|contains: - ' delete ' - .delete() - ' pause ' - ' stop ' - 'Stop-Service ' - 'Remove-Service ' - CommandLine|contains|all: - config - start=disabled selection_services: CommandLine|contains: - 143Svc - Acronis VSS Provider - AcronisAgent - AcrSch2Svc - AdobeARMservice - AHS Service - Antivirus - Apache4 - ARSM - aswBcc - AteraAgent - Avast Business Console Client Antivirus Service - avast! Antivirus - AVG Antivirus - avgAdminClient - AvgAdminServer - AVP1 - BackupExec - bedbg - BITS - BrokerInfrastructure - CASLicenceServer - CASWebServer - Client Agent 7.60 - Core Browsing Protection - Core Mail Protection -
Near-miss passage: Sigma rule: Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows t. Logsource: windows / ps_script. Rule: title: Suspicious PowerShell WindowStyle Option id: 313fbb0a-a341-4682-848d-6d6f8c4fab7c status: test description: 'Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.003/T1564.003.md author: frack113, Tim Shelton (fp AWS) date: 2021-10-20 modified: 2023-01-03 tags: - attack.stealth - attack.t1564.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - powershell - WindowStyle - Hidden filter: ScriptBlockText|contains|all: - :\Program Files\Amazon\WorkSpacesConfig\Scripts\ - $PSScriptRoot\Module\WorkspaceScriptModule\WorkspaceScriptModule condition: selection and not filter falsepositives: - Unknown level: medium