T1489
Service Stop
ESXi · IaaS · Linux · macOS · Windows2 pieces on this siteT1489 on attack.mitre.org
Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment. Adversaries may accomplish this by disabling individual services of high importance to an organization, such as `MSExchangeIS`, which will make Exchange content inaccessible.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Ransomware response plan: from the first renamed file to the review
The whole response rather than the first hour of it: who decides what, how to contain without destroying the evidence you will need, what has to be true before you restore, and the notifications whose clocks started before you noticed.
Ransomware, suspected or confirmed
Files renamed or unreadable, a ransom note, or backup deletion commands seen.
how MITRE says to see it
Behavioral Detection for Service Stop across Platforms
- Adversary disables or stops critical services (e.g., Exchange, SQL, AV, endpoint monitoring) using native utilities or API calls, often preceding destructive actions (T1485, T1486).
- Adversary executes systemctl or service stop targeting high-value services (e.g., mysql, sshd), possibly followed by rm or shred against data stores. Behavioral chain: sudo/su usage + stop command + /var/log/messages or syslog entries + file access/delete.
- Use of launchctl to stop services or kill critical background processes (e.g., securityd, com.apple.*), typically followed by command-line tools like rm or diskutil. Behavioral chain: Terminal or remote shell + launchctl bootout/disable + process termination + follow-on modification.
- Attacker disables VM-related services or stops VMs forcibly to target vmdk or logs. Behavioral chain: esxcli or vim-cmd stop + audit log showing user privilege use + datastore file manipulation.
what reduces it
- M1060 Out-of-Band Communications Channel. Develop and enforce security policies that include the use of out-of-band communication channels for critical communications during a security incident.
- M1030 Network Segmentation. Operate intrusion detection, analysis, and response systems on a separate network from the production environment to lessen the chances that an adversary can see and interfere with critical response functions.
- M1018 User Account Management. Limit privileges of user accounts and groups so that only authorized administrators can interact with service changes and service configurations.
- M1022 Restrict File and Directory Permissions. Ensure proper process and file permissions are in place to inhibit adversaries from disabling or interfering with critical services.
- M1024 Restrict Registry Permissions. Ensure proper registry permissions are in place to inhibit adversaries from disabling or interfering with critical services.