MITRE ATT&CKtechnique

T0881 Service Stop

Published 2020-05-21 Modified 2026-10-13 Official page ↗

Domain: ics
Tactics: Inhibit Response Function
Platforms: Embedded, Windows, Linux, Network Devices
Version: 1.1
Created: 2020-05-21

Description

Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment. Services may not allow for modification of their data stores while running. Adversaries may stop services in order to conduct Data Destruction.

Tactic · MITRE ATT&CK (1)

TA0107 Inhibit Response Function tactic

Referenced by MITRE ATT&CK · mitigates (4)

M0930 Network Segmentation mitigation
M0918 User Account Management mitigation
M0922 Restrict File and Directory Permissions mitigation
M0924 Restrict Registry Permissions mitigation

Referenced by MITRE ATT&CK · uses (5)

S1072 Industroyer2 software (malware)
S0605 EKANS software (malware)
S0607 KillDisk software (malware)
S0604 Industroyer software (malware)
S0496 REvil software (malware)

References

https://attack.mitre.org/techniques/T1489/ Enterprise ATT&CK