Automation · API / MCP 中文

Technique note · T1489

Service Stop

Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment. Adversaries may accomplish this by disabling individual services of high importance to an organization, such as <code>MSExchangeIS</code>, which will make Exchange content inaccessible. In some cases, adversaries may stop or disable many or all services to render systems unusable. Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct Data Destruction or Data Encrypted for Impact on the data stores of services like Exchange and SQL Server, or on virtual machines hosted on ESXi infrastructure. Threat actors may also disable or stop service in cloud environments. For example, by leveraging the `DisableAPIServiceAccess` API in AWS, a threat actor may prevent the service from creating service-linked roles on new accounts in the AWS Organization.

ATT&CK T1489 platforms — Status Active Version 20.1

Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.12 Adversaries may accomplish this by disabling individual services of high importance to an organization, such as <code>MSExchangeIS</code>, which will make Exchange content inaccessible.3 In some cases, adversaries may stop or disable many or all services to render systems unusable.4 Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct Data Destruction or Data Encrypted for Impact on the data stores of services like Exchange and SQL Server, or on virtual machines hosted on ESXi infrastructure.56 Threat actors may also disable or stop service in cloud environments. For example, by leveraging the `DisableAPIServiceAccess` API in AWS, a threat actor may prevent the service from creating service-linked roles on new accounts in the AWS Organization.78

  1. Talos Olympic Destroyer 2018
  2. Novetta Blockbuster
  3. Novetta Blockbuster
  4. Talos Olympic Destroyer 2018
  5. SecureWorks WannaCry Analysis
  6. Crowdstrike Hypervisor Jackpotting Pt 2 2021
  7. Datadog Security Labs Cloud Persistence 2025
  8. AWS DisableAWSServiceAccess

Groups using this technique

GroupNameCountry
grp_g0032Lazarus GroupDPRK
grp_g0119Indrik SpiderRussia
grp_g1051Medusa Group—
grp_g0102Wizard SpiderRussia
grp_g1004LAPSUS$—
grp_g0094KimsukyDPRK
grp_g0034Sandworm TeamRussia

Claims

No public claim points at this technique yet.

Auto-ingested and not human-reviewed; confidence and validity read by citation.