Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities

Read More

Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts

Read More

An application has been removed. Check if it is critical.

Read More

Identifies when a application is deleted in Azure.

Read More

Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users.

Read More

Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities

Read More

Detects when adversaries try to stop system services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities

Read More

Detects the stopping of a Windows service via the "net" utility.

Read More

Detects the stopping of a Windows service via the PowerShell Cmdlet "Stop-Service"

Read More

Detects the stopping of a Windows service via the "sc.exe" utility

Read More