t1489-service-stop

name	T1489_service-stop
description	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
category	business-logic
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1489","impact","esxi","iaas","linux","macos","windows"]
technique_id	T1489
tactic	impact
all_tactics	["impact"]
platforms	["ESXi","IaaS","Linux","macOS","Windows"]
mitre_url	https://attack.mitre.org/techniques/T1489
tech_stack	["esxi","cloud","linux","macos","windows"]
cwe_ids	["CWE-400"]
chains_with	[]
prerequisites	[]
severity_boost	{}

T1489 Service Stop

High-Level Description

Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.

Adversaries may accomplish this by disabling individual services of high importance to an organization, such as MSExchangeIS, which will make Exchange content inaccessible. In some cases, adversaries may stop or disable many or all services to render systems unusable. Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct Data Destruction or Data Encrypted for Impact on the data stores of services like Exchange and SQL Server, or on virtual machines hosted on ESXi infrastructure.

Threat actors may also disable or stop service in cloud environments. For example, by leveraging the DisableAPIServiceAccess API in AWS, a threat actor may prevent the service from creating service-linked roles on new accounts in the AWS Organization.

Kill Chain Phase

• Impact (TA0040)

Platforms: ESXi, IaaS, Linux, macOS, Windows

What to Check

• Identify if Service Stop technique is applicable to target environment
• Check ESXi systems for indicators of Service Stop
• Check IaaS systems for indicators of Service Stop
• Check Linux systems for indicators of Service Stop
• Verify mitigations are bypassed or absent (5 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Windows - Stop service using Service Controller

Stops a specified service using the sc.exe command. Upon execution, if the spooler service was running infomration will be displayed saying it has changed to a state of STOP_PENDING. If the spooler service was not running "The service has not been started." will be displayed and it can be started by running the cleanup command.

Supported Platforms: windows Yes