title: Stop multiple services status: experimental description: Stop multiple services author: Joe Security date: 2019-12-30 id: 200040 threatname: behaviorgroup: 18 classification: 8 mitreattack: logsource: category: process_creation product: windows detection: selection: CommandLine: - '*cmd*net stop*& net stop*& net stop*& net stop*& net stop*& net stop*& net stop*' condition: selection level: critical