Techniques › T1489
T1489 Service Stop
impact — ESXi, IaaS, Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
20
Sigma rules tagged attack.t1489
1
KEV CVEs mapped here
<p>Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.</p><p>Adversaries may accomplish this by disabling individual services of high importance to an organization, such as <code>MSExchangeIS</code>, which will make Exchange content inaccessible. In some cases, adversaries may stop or disable many or all services to render systems unusable. Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct Data Destruction or Data Encrypted for Impact on the data stores of services like Exchange and SQL Server, or on virtual machines hosted on ESXi infrastructure.</p><p>Threat actors may also disable or stop service in cloud environments. For example, by leveraging the
DisableAPIServiceAccess API in AWS, a threat actor may prevent the service from creating service-linked roles on new accounts in the AWS Organization.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2023-36884 | Microsoft Windows | secondary impact | Stale | 2023-07-17 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0021 Behavioral Detection for Service Stop across Platforms v1.0
AN0061 WindowsAdversary disables or stops critical services (e.g., Exchange, SQL, AV, endpoint monitoring) using native utilities or API calls, often preceding destructive actions (T1485, T1486). Behavioral chain: Elevated execution context + stop-service or sc.exe or ChangeServiceConfigW + terminated or disabled service + possible follow-up file manipulation.Tunable:
TimeWindowServiceNameParentProcessAN0062 LinuxAdversary executes systemctl or service stop targeting high-value services (e.g., mysql, sshd), possibly followed by rm or shred against data stores. Behavioral chain: sudo/su usage + stop command + /var/log/messages or syslog entries + file access/delete.Tunable:TimeWindowExecUserAN0063 macOSUse of launchctl to stop services or kill critical background processes (e.g., securityd, com.apple.*), typically followed by command-line tools like rm or diskutil. Behavioral chain: Terminal or remote shell + launchctl bootout/disable + process termination + follow-on modification.Tunable:ServiceLabelLaunchTypeAN0064 ESXiAttacker disables VM-related services or stops VMs forcibly to target vmdk or logs. Behavioral chain: esxcli or vim-cmd stop + audit log showing user privilege use + datastore file manipulation.esxi:hostdLog entries indicating VM powered off or forcibly terminated→ DC0033 Process TerminationTunable:VMNameInitiatorUser
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1489
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 08d6ac24-c927-4469-b3b7-2e422d6e3c43
Identifies when a Azure Kubernetes network policy is modified or deleted.
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 12d027c3-b48c-4d9d-8bb6-a732200034b2
Identifies when a service account is modified or deleted.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-09-09 · logsource: product=windows category=process_creation · 220457c1-1c9f-4c2e-afe6-9598926222c1
Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users.
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 25cb259b-bbdc-4b87-98b7-90d7c72f8743
Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.
Author: Austin Songer @austinsonger
· 2021-09-03 (modified 2026-04-30) · logsource: product=azure service=auditlogs · 410d2a41-1e6d-452f-85e5-abdd8257a823
Identifies when a application is deleted in Azure.
Author: frack113
· 2022-01-28 (modified 2022-09-17) · logsource: product=windows service=application · 570ae5ec-33dc-427c-b815-db86228ad43e
An application has been removed. Check if it is critical.
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 7ee0b4aa-d8d4-4088-b661-20efdf41a04c
Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 818fee0c-e0ec-4e45-824e-83e4817b0887
Identifies when ClusterRoles/Roles are being modified or deleted.
Author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)
· 2023-03-05 (modified 2024-01-18) · logsource: product=windows category=process_creation · 81bcb81b-5b1f-474b-b373-52c871aaa7b1
Detects the stopping of a Windows service via the "sc.exe" utility
Author: frack113, MalGamy (Nextron Systems), Nasreddine Bencherchali
· 2021-12-26 (modified 2024-10-06) · logsource: product=windows category=process_creation · 86085955-ea48-42a2-9dd3-85d4c36b167d
Detects execution of "taskkill.exe" in order to stop a service or a process. Look for suspicious parents executing this command in order to hunt for potential malicious activity.
Attackers might leverage this in order to conduct data destruction or data encrypted for impact on the data stores of services like Exchange and SQL Server.
Author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)
· 2023-03-05 · logsource: product=windows category=process_creation · 88872991-7445-4a22-90b2-a3adadb0e827
Detects the stopping of a Windows service via the "net" utility.
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 93e0ef48-37c8-49ed-a02c-038aab23628e
Detects when a Container Registry is created or deleted.
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 9541f321-7cba-4b43-80fc-fbd1fb922808
Detects when a Azure Kubernetes Cluster is created or deleted.
Author: frack113, Nasreddine Bencherchali (Nextron Systems), X__Junior
· 2021-12-26 (modified 2026-03-11) · logsource: product=windows category=process_creation · 9ac94dc8-9042-493c-ba45-3b5e7c86b980
Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities
Author: frack113
· 2023-01-13 (modified 2026-03-11) · logsource: product=windows service=taskscheduler · 9e3cb244-bdb8-4632-8c90-6079c8f4f16d
Detects when adversaries try to stop system services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities
Author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)
· 2023-03-05 · logsource: product=windows category=process_creation · c49c5062-0966-4170-9efd-9968c913a6cf
Detects the stopping of a Windows service via the PowerShell Cmdlet "Stop-Service"
Author: Nasreddine Bencherchali (Nextron Systems), frack113 , X__Junior (Nextron Systems)
· 2022-09-01 (modified 2025-08-27) · logsource: product=windows category=process_creation · ce72ef99-22f1-43d4-8695-419dcb5d9330
Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-09-09 (modified 2026-03-11) · logsource: product=windows category=process_creation · dbc1f800-0fe0-4bc0-9c66-292c2abe3f78
Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-09-15 (modified 2025-03-18) · logsource: product=linux category=process_creation · de25eeb8-3655-4643-ac3a-b662d3f26b6b
Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services on Linux systems.
Attackers may stop or disable security tools and services to evade detection, maintain persistence, or disrupt system operations.
Author: Milad Cheraghi
· 2025-05-23 · logsource: product=linux service=auditd · ea61bb82-a5e0-42e6-8537-91d29500f1b9
Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges
to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes,
or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be
misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.