T1489 Service Stop Targeting Security and Backup Services

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

Detects attempts to stop or disable critical security, backup, and logging services on Windows systems using command-line utilities (net.exe, sc.exe) or PowerShell. Adversaries frequently perform these actions to impair defensive monitoring, bypass security controls, or prepare the system for destructive activities like ransomware deployment.