Detecting Ransomware Stopping Services and Processes

Databases, mail stores, virtual machine hosts and backup agents keep their files locked, and security tools can interfere with the encryptor. Ransomware therefore stops or kills them first, often dozens in a row from a scripted list. The individual commands are common, but the burst, the targets and the context are what make the detection.

Signals at a Glance

Burst and Target Mix

One service stop is routine. Ten distinct stops of database, backup and security services in two minutes from one parent is not. This hunt counts distinct targets per parent process and host, then flags target-type diversity:

// KQL - burst of service/process stops from one parent
DeviceProcessEvents
| where Timestamp > ago(1h)
| where (FileName =~ "net.exe" or FileName =~ "net1.exe") and ProcessCommandLine has " stop "
     or (FileName =~ "sc.exe" and ProcessCommandLine has_any (" stop ", "config") and ProcessCommandLine has "disabled")
     or (FileName =~ "taskkill.exe" and ProcessCommandLine has "/f")
     or (FileName =~ "powershell.exe" and ProcessCommandLine has_any ("Stop-Service", "Stop-Process"))
| summarize stops=count(), distinctCmds=dcount(ProcessCommandLine),
            sample=make_set(ProcessCommandLine, 10)
          by DeviceName, InitiatingProcessFileName, AccountName, bin(Timestamp, 5m)
| where stops >= 8 and distinctCmds >= 6
| order by stops desc
// tune/validate: patch windows and application deployment will trip this; allowlist by change ticket window.

Add a target-type check to separate maintenance from ransomware. Maintenance stops one application stack; ransomware sweeps across categories:

// KQL - category diversity across the sampled commands
let dbTerms  = dynamic(["sql","oracle","mysql","postgres","mongo"]);
let bkTerms  = dynamic(["veeam","backup","acronis","vss"]);
let avTerms  = dynamic(["defender","sophos","mcafee","symantec","crowdstrike","endpoint"]);
DeviceProcessEvents
| where Timestamp > ago(1h) and ProcessCommandLine has_any ("stop", "taskkill", "disabled")
| extend isDb = ProcessCommandLine has_any (dbTerms),
         isBk = ProcessCommandLine has_any (bkTerms),
         isAv = ProcessCommandLine has_any (avTerms)
| summarize db=countif(isDb), bk=countif(isBk), av=countif(isAv)
          by DeviceName, AccountName, bin(Timestamp, 10m)
| where (db > 0) + (bk > 0) + (av > 0) >= 2
// Two or more categories in 10 minutes is the pre-encryption pattern.

Tuning Notes

• Windows service events 7036 and 7040 give you state changes even when the command line is obfuscated or run through an API, so enable them and compare against the process telemetry.
• Security-service stops deserve their own high-severity alert regardless of count. Tamper protection and EDR self-protection should log these as well.
• Allowlist patching and deployment tooling by signed image and account, and pull the change calendar into suppression where you can.