Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster)
Adversaries may accomplish this by disabling individual services of high importance to an organization, such as <code>MSExchangeIS</code>, which will make Exchange content inaccessible.(Citation: Novetta Blockbuster) In some cases, adversaries may stop or disable many or all services to render systems unusable.(Citation: Talos Olympic Destroyer 2018) Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct Data Destruction or Data Encrypted for Impact on the data stores of services like Exchange and SQL Server.(Citation: SecureWorks WannaCry Analysis)
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| PR.IR-01.01 | Network segmentation | Mitigates | T1489 | Service Stop |
Comments
This diagnostic statement is for the implementation of network segmentation which helps prevent access to critical systems and sensitive information. Employing defense-in-depth and access isolation provides protection against adversaries attempting to stop services.
References
|
| PR.AA-01.01 | Identity and credential management | Mitigates | T1489 | Service Stop |
Comments
This diagnostic statement protects against Service Stop through the use of hardened access control policies, secure defaults, password complexity requirements, multifactor authentication requirements, and removal of terminated accounts.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CA-07 | Continuous Monitoring | mitigates | T1489 | Service Stop | |
| CM-06 | Configuration Settings | mitigates | T1489 | Service Stop | |
| CM-05 | Access Restrictions for Change | mitigates | T1489 | Service Stop | |
| SC-37 | Out-of-band Channels | mitigates | T1489 | Service Stop | |
| SC-46 | Cross Domain Policy Enforcement | mitigates | T1489 | Service Stop | |
| IA-02 | Identification and Authentication (Organizational Users) | mitigates | T1489 | Service Stop | |
| CM-07 | Least Functionality | mitigates | T1489 | Service Stop | |
| SI-04 | System Monitoring | mitigates | T1489 | Service Stop | |
| AC-02 | Account Management | mitigates | T1489 | Service Stop | |
| AC-03 | Access Enforcement | mitigates | T1489 | Service Stop | |
| AC-04 | Information Flow Enforcement | mitigates | T1489 | Service Stop | |
| AC-05 | Separation of Duties | mitigates | T1489 | Service Stop | |
| AC-06 | Least Privilege | mitigates | T1489 | Service Stop | |
| SC-07 | Boundary Protection | mitigates | T1489 | Service Stop |
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| action.hacking.variety.Disable controls | Disable or interfere with security controls | related-to | T1489 | Service Stop | |
| action.malware.variety.DoS | DoS attack | related-to | T1489 | Service Stop | |
| attribute.availability.variety.Interruption | Interruption | related-to | T1489 | Service Stop |
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| alerts_for_windows_machines | Alerts for Windows Machines | technique_scores | T1489 | Service Stop |
Comments
This control may detect when critical services have been disabled through the usage of specifically net.exe. The following alerts may be generated: "Detected the disabling of critical services".
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| amazon_inspector | Amazon Inspector | technique_scores | T1489 | Service Stop |
Comments
The Amazon Inspector Best Practices assessment package can assess security control "Configure permissions for system directories" that prevents privilege escalation by local users and ensures only the root account can modify/execute system configuration information and binaries. Amazon Inspector does not directly protect against system modifications rather it just checks to see if security controls are in place which can inform decisions around hardening the system. Due to this and the fact the security control is only supported for Linux platforms, the score is Minimal.
References
|
| aws_rds | AWS RDS | technique_scores | T1489 | Service Stop |
Comments
AWS RDS generates events for database instances and includes the following event that may indicate that an adversary has attempted to stop a database instance.
RDS-EVENT-0087: The DB instance has been stopped
This mapping is given a score of Partial because it can't differentiate between an authorized and unauthorized stopping of the database instance.
References
|