attack.t1489

Suspicious Windows Service Tampering

Dec 27, 2024 · attack.defense-evasion attack.t1489 attack.t1562.001 ·

Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts

Disable Important Scheduled Task

Aug 26, 2024 · attack.impact attack.t1489 ·

Share on:

Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities

Application Uninstalled

Aug 12, 2024 · attack.impact attack.t1489 ·

Share on:

An application has been removed. Check if it is critical.

Azure Application Deleted

Aug 12, 2024 · attack.defense-evasion attack.impact attack.t1489 ·

Share on:

Identifies when a application is deleted in Azure.

Delete All Scheduled Tasks

Aug 12, 2024 · attack.impact attack.t1489 ·

Share on:

Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users.

Delete Important Scheduled Task

Aug 12, 2024 · attack.impact attack.t1489 ·

Share on:

Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities

Important Scheduled Task Deleted

Aug 12, 2024 · attack.impact attack.t1489 ·

Share on:

Detects when adversaries try to stop system services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities

Stop Windows Service Via Net.EXE

Aug 12, 2024 · attack.impact attack.t1489 ·

Share on:

Detects the stopping of a Windows service via the "net" utility.

Stop Windows Service Via PowerShell Stop-Service

Aug 12, 2024 · attack.impact attack.t1489 ·

Share on:

Detects the stopping of a Windows service via the PowerShell Cmdlet "Stop-Service"