Skip to content

T1489.md

Latest commit

 

History

History
227 lines (153 loc) · 9.58 KB

T1489.md

File metadata and controls

227 lines (153 loc) · 9.58 KB

T1489 - Service Stop

Description from ATT&CK

Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster)

Adversaries may accomplish this by disabling individual services of high importance to an organization, such as MSExchangeIS, which will make Exchange content inaccessible.(Citation: Novetta Blockbuster) In some cases, adversaries may stop or disable many or all services to render systems unusable.(Citation: Talos Olympic Destroyer 2018) Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct Data Destruction or Data Encrypted for Impact on the data stores of services like Exchange and SQL Server, or on virtual machines hosted on ESXi infrastructure.(Citation: SecureWorks WannaCry Analysis)(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)

Threat actors may also disable or stop service in cloud environments. For example, by leveraging the DisableAPIServiceAccess API in AWS, a threat actor may prevent the service from creating service-linked roles on new accounts in the AWS Organization.(Citation: Datadog Security Labs Cloud Persistence 2025)(Citation: AWS DisableAWSServiceAccess)

Source

Atomic Tests

Atomic Test #1: Windows - Stop service using Service Controller

Stops a specified service using the sc.exe command. Upon execution, if the spooler service was running infomration will be displayed saying it has changed to a state of STOP_PENDING. If the spooler service was not running "The service has not been started." will be displayed and it can be started by running the cleanup command.

Supported Platforms: Windows

auto_generated_guid: 21dfb440-830d-4c86-a3e5-2a491d5a8d04

Inputs

Name Description Type Default Value
service_name Name of a service to stop string spooler

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

sc.exe stop #{service_name}

Cleanup Commands

sc.exe start #{service_name} >nul 2>&1

Atomic Test #2: Windows - Stop service using net.exe

Stops a specified service using the net.exe command. Upon execution, if the service was running "The Print Spooler service was stopped successfully." will be displayed. If the service was not running, "The Print Spooler service is not started." will be displayed and it can be started by running the cleanup command.

Supported Platforms: Windows

auto_generated_guid: 41274289-ec9c-4213-bea4-e43c4aa57954

Inputs

Name Description Type Default Value
service_name Name of a service to stop string spooler

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

net.exe stop #{service_name}

Cleanup Commands

net.exe start #{service_name} >nul 2>&1

Atomic Test #3: Windows - Stop service by killing process

Stops a specified service killng the service's process. This technique was used by WannaCry. Upon execution, if the spoolsv service was running "SUCCESS: The process "spoolsv.exe" with PID 2316 has been terminated." will be displayed. If the service was not running "ERROR: The process "spoolsv.exe" not found." will be displayed and it can be started by running the cleanup command.

Supported Platforms: Windows

auto_generated_guid: f3191b84-c38b-400b-867e-3a217a27795f

Inputs

Name Description Type Default Value
process_name Name of a process to kill string spoolsv.exe

Attack Commands: Run with command_prompt!

taskkill.exe /f /im #{process_name}

Atomic Test #4: Linux - Stop service using systemctl

Stops a specified service using the systemctl command. Upon execution, if the specified service was running, it will change to a state of inactive and it can be restarted by running the cleanup command. You can list all available services with following command: "systemctl list-units --type=service"

Supported Platforms: Linux

auto_generated_guid: 42e3a5bd-1e45-427f-aa08-2a65fa29a820

Inputs

Name Description Type Default Value
service_name Name of a service to stop string cron

Attack Commands: Run with sh! Elevation Required (e.g. root or admin)

sudo systemctl stop #{service_name}

Cleanup Commands

sudo systemctl start #{service_name} 2> /dev/null

Atomic Test #5: Linux - Stop service by killing process using killall

Stops a specified service by sending a SIGTERM signal to the linked process using the killall command. Upon execution, if the service's main process was running, it will be terminated. If the service was not running, no process will be found to kill and it can be restarted by running the cleanup command. You can list all available services with following command: "systemctl list-units --type=service"

Supported Platforms: Linux

auto_generated_guid: e5d95be6-02ee-4ff1-aebe-cf86013b6189

Inputs

Name Description Type Default Value
process_name Name of a process to stop string cron
service_name Name of a service to restart string cron

Attack Commands: Run with sh! Elevation Required (e.g. root or admin)

sudo killall -SIGTERM #{process_name}

Cleanup Commands

sudo systemctl start #{service_name} 2> /dev/null

Atomic Test #6: Linux - Stop service by killing process using kill

Stops a specified service by sending a SIGTERM signal to the linked process using the kill command. Upon execution, if the service's main process was running, it will be terminated. If the service was not running, no process will be found to kill and it can be restarted by running the cleanup command. You can list all available services with following command: "systemctl list-units --type=service"

Supported Platforms: Linux

auto_generated_guid: 332f4c76-7e96-41a6-8cc2-7361c49db8be

Inputs

Name Description Type Default Value
process_name Name of a process to kill string cron
service_name Name of a service to restart string cron

Attack Commands: Run with sh! Elevation Required (e.g. root or admin)

sudo kill -SIGTERM $(pgrep #{process_name})

Cleanup Commands

sudo systemctl start #{service_name} 2> /dev/null

Atomic Test #7: Linux - Stop service by killing process using pkill

Stops a specified service by sending a SIGTERM signal to the linked process using pkill. This method is effective when multiple instances of the process may be running. Upon execution, if any instances of the process were running, they will be terminated. If no instances were running, pkill will not find any processes to kill. Stopped service can be restarted by running the cleanup command. You can list all available services with following command: "systemctl list-units --type=service"

Supported Platforms: Linux

auto_generated_guid: 08b4718f-a8bf-4bb5-a552-294fc5178fea

Inputs

Name Description Type Default Value
process_pattern Pattern to match the name of the process to kill string ^cron$
service_name Name of a service to restart string cron

Attack Commands: Run with sh! Elevation Required (e.g. root or admin)

sudo pkill -SIGTERM #{process_pattern}

Cleanup Commands

sudo systemctl start #{service_name} 2> /dev/null

Atomic Test #8: Abuse of linux magic system request key for Send a SIGTERM to all processes

Adversaries with root or sufficient privileges Send a SIGTERM to all processes, except for init. By writing 'e' to /proc/sysrq-trigger, they can forced kill all processes, except for init.

Supported Platforms: Linux

auto_generated_guid: 6e76f56f-2373-4a6c-a63f-98b7b72761f1

Attack Commands: Run with bash! Elevation Required (e.g. root or admin)

echo "e" > /proc/sysrq-trigger
⚡