MITRE ATT&CKtechnique

T1489 Service Stop

Published 2019-03-29 Modified 2026-09-11 Official page ↗
Domain
enterprise
Tactics
Impact
Platforms
ESXi, IaaS, Linux, macOS, Windows
Version
1.4
Created
2019-03-29

Description

Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment. Adversaries may accomplish this by disabling individual services of high importance to an organization, such as MSExchangeIS, which will make Exchange content inaccessible. In some cases, adversaries may stop or disable many or all services to render systems unusable. Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct Data Destruction or Data Encrypted for Impact on the data stores of services like Exchange and SQL Server, or on virtual machines hosted on ESXi infrastructure. Threat actors may also disable or stop service in cloud environments. For example, by leveraging the `DisableAPIServiceAccess` API in AWS, a threat actor may prevent the service from creating service-linked roles on new accounts in the AWS Organization.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (5)

  • M1060 Out-of-Band Communications Channel mitigation
  • M1030 Network Segmentation mitigation
  • M1018 User Account Management mitigation
  • M1022 Restrict File and Directory Permissions mitigation
  • M1024 Restrict Registry Permissions mitigation

Referenced by MITRE ATT&CK · uses (57)

  • S9052 MiniFast software (malware)
  • S9051 The Gentlemen Ransomware software (malware)
  • S9050 Vidar software (malware)
  • S9014 PHASEJAM software (malware)
  • S9015 BRICKSTORM software (malware)
  • S9013 DRYHOOK software (malware)
  • S1247 Embargo software (malware)
  • S1244 Medusa Ransomware software (malware)
  • S1245 InvisibleFerret software (malware)
  • G1051 Medusa Group group
  • S1242 Qilin software (malware)
  • S1217 VIRTUALPITA software (malware)
  • S1212 RansomHub software (malware)
  • S1211 Hannotog software (malware)
  • S1202 LockBit 3.0 software (malware)
  • S1199 LockBit 2.0 software (malware)
  • S1194 Akira _v2 software (malware)
  • S1191 Megazord software (malware)
  • S1181 BlackByte 2.0 Ransomware software (malware)
  • S1150 ROADSWEEP software (malware)
  • S1139 INC Ransomware software (malware)
  • S1096 Cheerscrypt software (malware)
  • S1073 Royal software (malware)
  • S1068 BlackCat software (malware)
  • S1058 Prestige software (malware)
  • S1053 AvosLocker software (malware)
  • G1004 LAPSUS$ group
  • S0697 HermeticWiper software (malware)
  • S0688 Meteor software (malware)
  • S0659 Diavol software (malware)
Show all 57 ›

Referenced by Compliance · mitigates (16)

  • CIS-16.8 Separate Production and Non-Production Systems CIS Safeguard v8.1
  • CIS-6.8 Define and Maintain Role-Based Access Control CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-SC-37 Out-of-band Channels NIST 800-53 control
  • NIST-SC-46 Cross Domain Policy Enforcement NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References