Applied Cybernetics Group
T1489 Service Stop
- Technique
T1489- Tactics
- Impact
- Research, 90 days
- 1
- KEV CVEs mapped
- 1
- SigmaHQ rules
- 20
- Elastic, Splunk
- 38
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1489
MITRE description
Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster) Adversaries may accomplish this by disabling individual services of high importance to an organization, such as <code>MSExchangeIS</code>, which will make Exchange content inaccessible.(Citation: Novetta Blockbuster) In some cases, adversaries may stop or disable many or all services to render systems unusable.(Citation: Talos Olympic Destroyer 2018) Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct [Data Destruction](https://attack.mitre.org/techniques/T1485) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) on the data stores of services like Exchange and SQL Server, or on virtual machines hosted on ESXi infrastructure.(Citation: SecureWorks WannaCry Analysis)(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021) Threat actors may also disable or stop service in cloud environments. For example, by leveraging the `DisableAPIServiceAccess` API in AWS, a threat actor may prevent the service from creating service-linked roles on new accounts in the AWS Organization.(Citation: Datadog Security Labs Cloud Persistence 2025)(Citation: AWS DisableAWSServiceAccess)
KEV CVEs mapped to this technique
MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-09-21Kaspersky Securelist: Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO
Detection coverage
SigmaHQ community rules
- Process Terminated Via Taskkill (threat-hunting)
- Azure Container Registry Created or Deleted (core)
- Azure Kubernetes Cluster Created or Deleted (core)
- Azure Kubernetes Network Policy Change (core)
- Azure Kubernetes Sensitive Role Access (core)
- Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted (core)
- Azure Kubernetes Secret or Config Object Access (core)
- Azure Kubernetes Service Account Modified or Deleted (core)
- Azure Application Deleted (core)
- Potential Abuse of Linux Magic System Request Key (core)
- Disable Or Stop Services (core)
- Application Uninstalled (core)
- Important Scheduled Task Deleted or Disabled (core)
- Stop Windows Service Via Net.EXE (core)
- Stop Windows Service Via PowerShell Stop-Service (core)
- Stop Windows Service Via Sc.EXE (core)
- Delete All Scheduled Tasks (core)
- Delete Important Scheduled Task (core)
- Disable Important Scheduled Task (core)
- Suspicious Windows Service Tampering (core)
Elastic and Splunk rules
- Elastic Agent Service Terminated (elastic)
- AWS EventBridge Rule Disabled or Deleted (elastic)
- AWS Lambda Function Deletion by Unusual User (elastic)
- Azure Storage Account Deletion by Unusual User (elastic)
- Azure Storage Account Deletions by User (elastic)
- Azure Kubernetes Services (AKS) Kubernetes Pods Deleted (elastic)
- Azure Resource Group Deleted by Unusual Principal (elastic)
- Process Killing Detected via Defend for Containers (elastic)
- GCP Pub/Sub Subscription Deletion (elastic)
- GCP Pub/Sub Topic Deletion (elastic)
- Attempt to Deactivate an Okta Application (elastic)
- Attempt to Delete an Okta Application (elastic)
- ESXi Virtual Machine Process Killed (elastic)
- Attempt to Disable Auditd Service (elastic)
- Attempt to Disable IPTables or Firewall (elastic)
- Attempt to Disable Syslog Service (elastic)
- Kill Command Execution (elastic)
- Suspicious Termination of ESXI Process (elastic)
- High Number of Process Terminations (elastic)
- Decline in host-based traffic (elastic)
- High Number of Process and/or Service Terminations (elastic)
- Service Disabled via Registry Modification (elastic)
- Excessive Attempt To Disable Services (splunk)
- Linux Auditd Auditd Service Stop (splunk)
- Linux Auditd Osquery Service Stop (splunk)
Showing 25 of 38.