Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster)
Adversaries may accomplish this by disabling individual services of high importance to an organization, such as <code>MSExchangeIS</code>, which will make Exchange content inaccessible (Citation: Novetta Blockbuster). In some cases, adversaries may stop or disable many or all services to render systems unusable.(Citation: Talos Olympic Destroyer 2018) Services may not allow for modification of their data stores while running. Adversaries may stop services in order to conduct Data Destruction or Data Encrypted for Impact on the data stores of services like Exchange and SQL Server.(Citation: SecureWorks WannaCry Analysis)
View in MITRE ATT&CK®Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name |
---|---|---|---|---|
AC-2 | Account Management | Protects | T1489 | Service Stop |
AC-3 | Access Enforcement | Protects | T1489 | Service Stop |
AC-4 | Information Flow Enforcement | Protects | T1489 | Service Stop |
AC-5 | Separation of Duties | Protects | T1489 | Service Stop |
AC-6 | Least Privilege | Protects | T1489 | Service Stop |
CA-7 | Continuous Monitoring | Protects | T1489 | Service Stop |
CM-5 | Access Restrictions for Change | Protects | T1489 | Service Stop |
CM-6 | Configuration Settings | Protects | T1489 | Service Stop |
CM-7 | Least Functionality | Protects | T1489 | Service Stop |
IA-2 | Identification and Authentication (organizational Users) | Protects | T1489 | Service Stop |
SC-46 | Cross Domain Policy Enforcement | Protects | T1489 | Service Stop |
SC-7 | Boundary Protection | Protects | T1489 | Service Stop |
SI-4 | System Monitoring | Protects | T1489 | Service Stop |
alerts_for_windows_machines | Alerts for Windows Machines | technique_scores | T1489 | Service Stop |