Service Stop

Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.[1][2]

Adversaries may accomplish this by disabling individual services of high importance to an organization, such as MSExchangeIS, which will make Exchange content inaccessible [2]. In some cases, adversaries may stop or disable many or all services to render systems unusable.[1] Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct Data Destruction or Data Encrypted for Impact on the data stores of services like Exchange and SQL Server.[3]

ID: T1489
Sub-techniques:  No sub-techniques
Tactic: Impact
Platforms: Linux, Windows, macOS
Permissions Required: Administrator, SYSTEM, User
Data Sources: Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Impact Type: Availability
Version: 1.2
Created: 29 March 2019
Last Modified: 02 March 2021

Procedure Examples

ID Name Description
S0575 Conti

Conti can stop up to 146 Windows services related to security, backup, database, and email solutions through the use of net stop.[4]

S0431 HotCroissant

HotCroissant has the ability to stop services on the infected host.[5]

G0032 Lazarus Group

Lazarus Group has stopped the MSExchangeIS service to render Exchange contents inaccessible to users.[6]

S0582 LookBack

LookBack can kill processes and delete services.[7]

S0449 Maze

Maze has stopped SQL services to ensure it can encrypt any database.[8]

S0576 MegaCortex

MegaCortex can stop and disable services on the system.[9]

S0457 Netwalker

Netwalker can terminate system processes and services, some of which relate to backup software.[10]

S0365 Olympic Destroyer

Olympic Destroyer uses the API call ChangeServiceConfigW to disable all services on the affected system.[1]

S0556 Pay2Key

Pay2Key can stop the MS SQL service at the end of the encryption process to release files locked by the service.[11]

S0583 Pysa

Pysa can stop services and processes.[12]

S0481 Ragnar Locker

Ragnar Locker has attempted to stop services associated with business applications and databases to release the lock on files used by these applications so they may be encrypted.[13]

S0496 REvil

REvil has the capability to stop services and kill processes.[14][15]

S0400 RobbinHood

RobbinHood stops 181 Windows services on the system before beginning the encryption process.[16]

S0446 Ryuk

Ryuk has called kill.bat for stopping services, disabling services and killing processes.[17]

S0533 SLOTHFULMEDIA

SLOTHFULMEDIA has the capability to stop processes and services.[18]

S0366 WannaCry

WannaCry attempts to kill processes associated with Exchange, Microsoft SQL Server, and MySQL to make it possible to encrypt their data stores.[19][3]

G0102 Wizard Spider

Wizard Spider has used taskkill.exe and net.exe to stop backup, catalog, cloud, and other services prior to network encryption.[20]

Mitigations

ID Mitigation Description
M1030 Network Segmentation

Operate intrusion detection, analysis, and response systems on a separate network from the production environment to lessen the chances that an adversary can see and interfere with critical response functions.

M1022 Restrict File and Directory Permissions

Ensure proper process and file permissions are in place to inhibit adversaries from disabling or interfering with critical services.

M1024 Restrict Registry Permissions

Ensure proper registry permissions are in place to inhibit adversaries from disabling or interfering with critical services.

M1018 User Account Management

Limit privileges of user accounts and groups so that only authorized administrators can interact with service changes and service configurations.

Detection

Monitor processes and command-line arguments to see if critical processes are terminated or stop running.

Monitor for edits for modifications to services and startup programs that correspond to services of high importance. Look for changes to services that do not correlate with known software, patch cycles, etc. Windows service information is stored in the Registry at HKLM\SYSTEM\CurrentControlSet\Services. Systemd service unit files are stored within the /etc/systemd/system, /usr/lib/systemd/system/, and /home/.config/systemd/user/ directories, as well as associated symbolic links.

Alterations to the service binary path or the service startup type changed to disabled may be suspicious.

Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. For example, ChangeServiceConfigW may be used by an adversary to prevent services from starting.[1]

References