自动化接入 · API / MCP EN

技术说明 · T1489

Service Stop

Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment. Adversaries may accomplish this by disabling individual services of high importance to an organization, such as <code>MSExchangeIS</code>, which will make Exchange content inaccessible. In some cases, adversaries may stop or disable many or all services to render systems unusable. Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct Data Destruction or Data Encrypted for Impact on the data stores of services like Exchange and SQL Server, or on virtual machines hosted on ESXi infrastructure. Threat actors may also disable or stop service in cloud environments. For example, by leveraging the `DisableAPIServiceAccess` API in AWS, a threat actor may prevent the service from creating service-linked roles on new accounts in the AWS Organization.

ATT&CK T1489 platforms — 状态 有效 版本 20.1

Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.12 Adversaries may accomplish this by disabling individual services of high importance to an organization, such as <code>MSExchangeIS</code>, which will make Exchange content inaccessible.3 In some cases, adversaries may stop or disable many or all services to render systems unusable.4 Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct Data Destruction or Data Encrypted for Impact on the data stores of services like Exchange and SQL Server, or on virtual machines hosted on ESXi infrastructure.56 Threat actors may also disable or stop service in cloud environments. For example, by leveraging the `DisableAPIServiceAccess` API in AWS, a threat actor may prevent the service from creating service-linked roles on new accounts in the AWS Organization.78

  1. Talos Olympic Destroyer 2018
  2. Novetta Blockbuster
  3. Novetta Blockbuster
  4. Talos Olympic Destroyer 2018
  5. SecureWorks WannaCry Analysis
  6. Crowdstrike Hypervisor Jackpotting Pt 2 2021
  7. Datadog Security Labs Cloud Persistence 2025
  8. AWS DisableAWSServiceAccess

使用该技术的组织

组织名称国家
grp_g0032Lazarus GroupDPRK
grp_g0119Indrik SpiderRussia
grp_g1051Medusa Group—
grp_g0102Wizard SpiderRussia
grp_g1004LAPSUS$—
grp_g0094KimsukyDPRK
grp_g0034Sandworm TeamRussia

断言

尚无指向该技术的公开断言。

记录自动入库·未人工复核；置信度与有效期按引用读取。