T1489 SMB SVCCTL Service Stop Targeting Security and Backup Services
Detects remote attempts to stop sensitive security, database, and system services using the SMB SVCCTL (Service Control Manager) interface. This is often associated with adversary attempts to disable defensive tools or prepare for destructive operations.
Suricata
