CyberStack

MITRE ATT&CK / Techniques / T1489

Service Stop

ID
T1489
Tactics
TA0040 Impact
Platforms
ESXi, IaaS, Linux, macOS, Windows
Data sources
Process Creation, Logon Session Metadata, Service Creation, Service Metadata, File Deletion, Process Termination
Source
attack.mitre.org
MITRE last modified
12 Sep 2026

Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.[2][3]

Adversaries may accomplish this by disabling individual services of high importance to an organization, such as MSExchangeIS, which will make Exchange content inaccessible.[3] In some cases, adversaries may stop or disable many or all services to render systems unusable.[2] Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct Data Destruction or Data Encrypted for Impact on the data stores of services like Exchange and SQL Server, or on virtual machines hosted on ESXi infrastructure.[4][5]

Threat actors may also disable or stop service in cloud environments. For example, by leveraging the DisableAPIServiceAccess API in AWS, a threat actor may prevent the service from creating service-linked roles on new accounts in the AWS Organization.[6][7]

Detection

Mitigations (5)

M1018 User Account Management

Limit privileges of user accounts and groups so that only authorized administrators can interact with service changes and service configurations.

M1022 Restrict File and Directory Permissions

Ensure proper process and file permissions are in place to inhibit adversaries from disabling or interfering with critical services.

M1024 Restrict Registry Permissions

Ensure proper registry permissions are in place to inhibit adversaries from disabling or interfering with critical services.

M1030 Network Segmentation

Operate intrusion detection, analysis, and response systems on a separate network from the production environment to lessen the chances that an adversary can see and interfere with critical response functions.

M1060 Out-of-Band Communications Channel

Develop and enforce security policies that include the use of out-of-band communication channels for critical communications during a security incident.[1]

Groups (7)

Software (50)

References

  1. TrustedSec OOB Communications
  2. Talos Olympic Destroyer 2018
  3. Novetta Blockbuster
  4. SecureWorks WannaCry Analysis
  5. Crowdstrike Hypervisor Jackpotting Pt 2 2021
  6. Datadog Security Labs Cloud Persistence 2025
  7. AWS DisableAWSServiceAccess