T1489 Service Stop Mappings

Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster)

Adversaries may accomplish this by disabling individual services of high importance to an organization, such as <code>MSExchangeIS</code>, which will make Exchange content inaccessible (Citation: Novetta Blockbuster). In some cases, adversaries may stop or disable many or all services to render systems unusable.(Citation: Talos Olympic Destroyer 2018) Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct Data Destruction or Data Encrypted for Impact on the data stores of services like Exchange and SQL Server.(Citation: SecureWorks WannaCry Analysis)



Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
AC-2 Account Management Protects T1489 Service Stop
AC-3 Access Enforcement Protects T1489 Service Stop
AC-4 Information Flow Enforcement Protects T1489 Service Stop
AC-5 Separation of Duties Protects T1489 Service Stop
AC-6 Least Privilege Protects T1489 Service Stop
CA-7 Continuous Monitoring Protects T1489 Service Stop
CM-5 Access Restrictions for Change Protects T1489 Service Stop
CM-6 Configuration Settings Protects T1489 Service Stop
CM-7 Least Functionality Protects T1489 Service Stop
IA-2 Identification and Authentication (organizational Users) Protects T1489 Service Stop
SC-46 Cross Domain Policy Enforcement Protects T1489 Service Stop
SC-7 Boundary Protection Protects T1489 Service Stop
SI-4 System Monitoring Protects T1489 Service Stop
CVE-2019-1886 Cisco Web Security Appliance (WSA) primary_impact T1489 Service Stop
CVE-2019-1711 Cisco IOS XR Software primary_impact T1489 Service Stop
CVE-2020-3134 Cisco Email Security Appliance (ESA) primary_impact T1489 Service Stop
CVE-2019-1747 Cisco IOS and IOS XE Software secondary_impact T1489 Service Stop
CVE-2019-3728 RSA BSAFE Crypto-C Micro Edition primary_impact T1489 Service Stop
action.malware.variety.DoS DoS attack related-to T1489 Service Stop
aws_rds AWS RDS technique_scores T1489 Service Stop
amazon_inspector Amazon Inspector technique_scores T1489 Service Stop