Service Stop

T1489

About this technique

Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.

Adversaries may accomplish this by disabling individual services of high importance to an organization, such as MSExchangeIS, which will make Exchange content inaccessible. In some cases, adversaries may stop or disable many or all services to render systems unusable. Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct Data Destruction or Data Encrypted for Impact on the data stores of services like Exchange and SQL Server, or on virtual machines hosted on ESXi infrastructure.

Threat actors may also disable or stop service in cloud environments. For example, by leveraging the `DisableAPIServiceAccess` API in AWS, a threat actor may prevent the service from creating service-linked roles on new accounts in the AWS Organization.

Detection rules39

Rules on DetectionCode tagged with T1489.

Sigma19

Rule	Level	Log source
Delete All Scheduled Tasks	high	windows / process_creation
Delete Important Scheduled Task	high	windows / process_creation
Disable Important Scheduled Task	high	windows / process_creation
Important Scheduled Task Deleted or Disabled	high	windows / NULL
Suspicious Windows Service Tampering	high	windows / process_creation
Azure Application Deleted	medium	azure / NULL
Azure Kubernetes Network Policy Change	medium	azure / NULL
Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted	medium	azure / NULL
Azure Kubernetes Secret or Config Object Access	medium	azure / NULL
Azure Kubernetes Sensitive Role Access	medium	azure / NULL
Azure Kubernetes Service Account Modified or Deleted	medium	azure / NULL
Disable Or Stop Services	medium	linux / process_creation
Potential Abuse of Linux Magic System Request Key	medium	linux / NULL
Application Uninstalled	low	windows / NULL
Azure Container Registry Created or Deleted	low	azure / NULL
Azure Kubernetes Cluster Created or Deleted	low	azure / NULL
Stop Windows Service Via Net.EXE	low	windows / process_creation
Stop Windows Service Via PowerShell Stop-Service	low	windows / process_creation
Stop Windows Service Via Sc.EXE	low	windows / process_creation

Splunk20

Rule	Type	Risk	Data source
Excessive Attempt To Disable Services	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Excessive Service Stop Attempt	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Linux Auditd Auditd Service Stop	Anomaly	NULL	Linux Auditd Service Stop
Linux Auditd Osquery Service Stop	Anomaly	NULL	Linux Auditd Service Stop
Linux Auditd Stop Services	Hunting	NULL	Linux Auditd Service Stop
Linux Auditd Sysmon Service Stop	Anomaly	NULL	Linux Auditd Service Stop
Linux Disable Services	TTP	NULL	Sysmon for Linux EventID 1
Linux Magic SysRq Key Abuse	TTP	NULL	Linux Auditd Path, Linux Auditd Cwd
Linux Stop Services	TTP	NULL	Sysmon for Linux EventID 1
Ollama Abnormal Service Crash Availability Attack	Anomaly	NULL	Ollama Server
Windows Excessive Service Stop Attempt	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Processes Killed By Industroyer2 Malware	Anomaly	NULL	Sysmon EventID 5
Windows Security Account Manager Stopped	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Service Deletion In Registry	Anomaly	NULL	Sysmon EventID 13
Windows Service Stop Attempt	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Service Stop By Deletion	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Service Stop Via Net and SC Application	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Service Stop Win Updates	Anomaly	NULL	Windows Event Log System 7040
Windows Set Account Password Policy To Unlimited Via Net	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Valid Account With Never Expires Password	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2

Groups7

Indrik Spider Kimsuky LAPSUS$Lazarus Group Medusa Group Sandworm Team Wizard Spider

Campaigns0

None recorded.

Procedure examples54

Groups7

Used by	Procedure example
GroupIndrik Spider	Indrik Spider has used PsExec to stop services prior to the execution of ransomware. Symantec WastedLocker June 2020
GroupKimsuky	Kimsuky has disabled actively running virtual environments using the `KillMe` function to include VMware, Microsoft Hypervisors, and VirtualBox. Aryaka Kimsuky July 2025
GroupLAPSUS$	LAPSUS$ has shut down virtual machines from within a victim's on-premise VMware ESXi infrastructure. NCC Group LAPSUS Apr 2022
GroupLazarus Group	Lazarus Group has stopped the MSExchangeIS service to render Exchange contents inaccessible to users. Novetta Blockbuster Destructive Malware
GroupMedusa Group	Medusa Group has terminated services related to backups, security, databases, communication, filesharing and websites. Broadcom Medusa Ransomware Medusa Group March 2025 CISA Medusa Group Medusa Ransomware March 2025 Security Scorecard Medusa Ransomware January 2024
GroupSandworm Team	Sandworm Team attempts to stop the MSSQL Windows service to ensure successful encryption of locked files. Microsoft Prestige ransomware October 2022
GroupWizard Spider	Wizard Spider has used taskkill.exe and net.exe to stop backup, catalog, cloud, and other services prior to network encryption. DFIR Ryuk's Return October 2020

Software47

Used by	Procedure example
MalwareAkira _v2	Akira _v2 can stop running virtual machines. CISA Akira Ransomware APR 2024 Cisco Akira Ransomware OCT 2024 Palo Alto Howling Scorpius DEC 2024
MalwareAvaddon	Avaddon looks for and attempts to stop database processes. Arxiv Avaddon Feb 2021
MalwareAvosLocker	AvosLocker has terminated specific processes before encryption. Malwarebytes AvosLocker Jul 2021
MalwareBabuk	Babuk can stop specific services related to backups. McAfee Babuk February 2021 Sogeti CERT ESEC Babuk March 2021 Trend Micro Ransomware February 2021
MalwareBlackByte 2.0 Ransomware	BlackByte 2.0 Ransomware can terminate running services. Microsoft BlackByte 2023
MalwareBlackCat	BlackCat has the ability to stop VM services on compromised networks. Microsoft BlackCat Jun 2022 Sophos BlackCat Jul 2022
MalwareBRICKSTORM	BRICKSTORM has terminated an existing process to ensure that its own new process can execute. CISA BRICKSTORM UNC5221 AR25-338A February 2026
MalwareCheerscrypt	Cheerscrypt has the ability to terminate VM processes on compromised hosts through execution of `esxcli vm process kill`. Trend Micro Cheerscrypt May 2022

View all 47 software examples

References6

AWS DisableAWSServiceAccess Open source
AWS. (n.d.). DisableAWSServiceAccess. Retrieved May 22, 2025.
Crowdstrike Hypervisor Jackpotting Pt 2 2021 Open source
Michael Dawson. (2021, August 30). Hypervisor Jackpotting, Part 2: eCrime Actors Increase Targeting of ESXi Servers with Ransomware. Retrieved March 26, 2025.
Datadog Security Labs Cloud Persistence 2025 Open source
Martin McCloskey. (2025, May 13). Tales from the cloud trenches: The Attacker doth persist too much, methinks. Retrieved May 22, 2025.
Novetta Blockbuster Open source
Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.
SecureWorks WannaCry Analysis Open source
Counter Threat Unit Research Team. (2017, May 18). WCry Ransomware Analysis. Retrieved March 26, 2019.
Talos Olympic Destroyer 2018 Open source
Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.