Stopping processes using net stop

id: 70c0b10a-3596-4903-baf2-60b5d453bf8c
name: Stopping processes using net stop
description: |
  This query checks for attempts to stop at least 10 separate processes using the net stop command. Run query
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Ransomware
query: |
  // Find attempts to stop processes using net stop
  DeviceProcessEvents
  | where Timestamp > ago(1d)
  | where FileName =~ "net.exe" and ProcessCommandLine has "stop"
  | summarize netStopCount = dcount(ProcessCommandLine), NetStopList = make_set(ProcessCommandLine) by DeviceId, bin(Timestamp, 2m)
  | where netStopCount > 10