Service Stop detection rulesT1489

Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users.

windows · process_creation

Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities

windows · process_creation

Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities

windows · process_creation

Detects when adversaries try to stop system services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities

windows

Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts

windows · process_creation

Identifies when a application is deleted in Azure.

azure

Identifies when a Azure Kubernetes network policy is modified or deleted.

azure

Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.

azure

Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.

azure

Identifies when ClusterRoles/Roles are being modified or deleted.

azure

Identifies when a service account is modified or deleted.

azure

Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services on Linux systems. Attackers may stop or disable security tools and services to evade detection, maintain persistence, or disrupt system operations.

linux · process_creation

Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes, or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.

linux

An application has been removed. Check if it is critical.

windows

Detects when a Container Registry is created or deleted.

azure

Detects when a Azure Kubernetes Cluster is created or deleted.

azure

Detects execution of "taskkill.exe" in order to stop a service or a process. Look for suspicious parents executing this command in order to hunt for potential malicious activity. Attackers might leverage this in order to conduct data destruction or data encrypted for impact on the data stores of services like Exchange and SQL Server.

windows · process_creation

Detects the stopping of a Windows service via the "net" utility.

windows · process_creation

Detects the stopping of a Windows service via the PowerShell Cmdlet "Stop-Service"

windows · process_creation

Detects the stopping of a Windows service via the "sc.exe" utility

windows · process_creation