Applied Cybernetics Group
T1489 — Service Stop
- Technique
T1489- Tactics
- Impact
- MISP citations
- 0
- KEV CVEs mapped
- 1
- Community rules
- 20
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1489
MITRE description
Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster) Adversaries may accomplish this by disabling individual services of high importance to an organization, such as <code>MSExchangeIS</code>, which will make Exchange content inaccessible.(Citation: Novetta Blockbuster) In some cases, adversaries may stop or disable many or all services to render systems unusable.(Citation: Talos Olympic Destroyer 2018) Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct [Data Destruction](https://attack.mitre.org/techniques/T1485) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) on the data stores of services like Exchange and SQL Server, or on virtual machines hosted on ESXi infrastructure.(Citation: SecureWorks WannaCry Analysis)(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021) Threat actors may also disable or stop service in cloud environments. For example, by leveraging the `DisableAPIServiceAccess` API in AWS, a threat actor may prevent the service from creating service-linked roles on new accounts in the AWS Organization.(Citation: Datadog Security Labs Cloud Persistence 2025)(Citation: AWS DisableAWSServiceAccess)
KEV CVEs mapped to this technique
Per MITRE CTID's hand-curated KEV→ATT&CK mappings — these are the actively-exploited vulnerabilities behind this technique's KEV signal.
Detection coverage
SigmaHQ community rules
- Process Terminated Via Taskkill (threat-hunting)
- Azure Application Deleted (core)
- Azure Container Registry Created or Deleted (core)
- Azure Kubernetes Cluster Created or Deleted (core)
- Azure Kubernetes Network Policy Change (core)
- Azure Kubernetes Sensitive Role Access (core)
- Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted (core)
- Azure Kubernetes Secret or Config Object Access (core)
- Azure Kubernetes Service Account Modified or Deleted (core)
- Potential Abuse of Linux Magic System Request Key (core)
- Disable Or Stop Services (core)
- Application Uninstalled (core)
- Important Scheduled Task Deleted or Disabled (core)
- Stop Windows Service Via Net.EXE (core)
- Stop Windows Service Via PowerShell Stop-Service (core)
- Stop Windows Service Via Sc.EXE (core)
- Delete All Scheduled Tasks (core)
- Delete Important Scheduled Task (core)
- Disable Important Scheduled Task (core)
- Suspicious Windows Service Tampering (core)