Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.[1][2]
Adversaries may accomplish this by disabling individual services of high importance to an organization, such as MSExchangeIS, which will make Exchange content inaccessible.[3] In some cases, adversaries may stop or disable many or all services to render systems unusable.[4] Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct Data Destruction or Data Encrypted for Impact on the data stores of services like Exchange and SQL Server, or on virtual machines hosted on ESXi infrastructure.[5][6]
Threat actors may also disable or stop service in cloud environments. For example, by leveraging the DisableAPIServiceAccess API in AWS, a threat actor may prevent the service from creating service-linked roles on new accounts in the AWS Organization.[7][8]
Top 23%of all ATT&CK techniques for number of groups
7 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Attempts to stop the MSSQL Windows service to ensure successful encryption of locked files.1
created 2017-05-311 referenceaka ELECTRUM
All 7 groups for this technique · 6 newest in this preview
47 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Has terminated active processes and services based on a hardcoded list using the CloseServiceHandle() function.1Embargo has also leveraged MS4Killer to terminate processes contained in an embedded list of security software process names that were XOR-encrypted.2
Has terminated Chrome and Brave browsers using the taskkill command on Windows and the killall command on other systems such as Linux and macOS.1InvisibleFerret has also utilized it’s ssh_kill command to terminate Chrome and Brave browser processes.2
Has the capability to terminate services related to backups, security, databases, communication, filesharing and websites.123Medusa Ransomware has also utilized the taskkill /F /IM <process> /T command to stop targeted processes and net stop <process> command to stop designated services.23
created 2025-10-17MALWAREcarried by 1 group
All 47 software entries for this technique · 6 newest in this preview
Offense vs defense T1489
Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.
Range
Technique Campaign use over its cumulative rule count.
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavioral Detection for Service Stop across Platforms
Enterprise
4 platforms
AN0061 · Windows
Adversary disables or stops critical services (e.g., Exchange, SQL, AV, endpoint monitoring) using native utilities or API calls, often preceding destructive actions (T1485, T1486). Behavioral chain: Elevated execution context + stop-service or sc.exe or ChangeServiceConfigW + terminated or disabled service + possible follow-up file manipulation.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
TimeWindow
Time span between elevated privilege use and critical service stop
ServiceName
Service names of interest (e.g., MSExchangeIS, SQLSERVERAGENT)
ParentProcess
Upstream process lineage leading to service stop
AN0062 · Linux
Adversary executes systemctl or service stop targeting high-value services (e.g., mysql, sshd), possibly followed by rm or shred against data stores. Behavioral chain: sudo/su usage + stop command + /var/log/messages or syslog entries + file access/delete.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
TimeWindow
Window between service stop and suspicious file deletion
ExecUser
Username or UID executing service stop command
AN0063 · macOS
Use of launchctl to stop services or kill critical background processes (e.g., securityd, com.apple.*), typically followed by command-line tools like rm or diskutil. Behavioral chain: Terminal or remote shell + launchctl bootout/disable + process termination + follow-on modification.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
ServiceLabel
Launch daemon label or name targeted by command
LaunchType
Whether the command disables or boots out the service
AN0064 · ESXi
Attacker disables VM-related services or stops VMs forcibly to target vmdk or logs. Behavioral chain: esxcli or vim-cmd stop + audit log showing user privilege use + datastore file manipulation.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
Operate intrusion detection, analysis, and response systems on a separate network from the production environment to lessen the chances that an adversary can see and interfere with critical response functions.
Develop and enforce security policies that include the use of out-of-band communication channels for critical communications during a security incident.
Limit privileges of user accounts and groups so that only authorized administrators can interact with service changes and service configurations.
Tests9Executorssh 4 · command_prompt 3 · bash 1 · powershell 1Need elevation8 of 9Have prerequisites1Have cleanup7Platformswindows, linux
#
Test
Platform
Executor
Elevation
Prereqs
Cleanup
Ref
01
Windows - Stop service using Service Controller
windows
command_prompt
Required
—
Yes
Stops a specified service using the sc.exe command. Upon execution, if the spooler service was running infomration will be displayed saying
it has changed to a state of STOP_PENDING. If the spooler service was not running "The service has not been started." will be displayed and it can be
started by running the cleanup command.
Inputs
Name
Description
Type
Default Value
service_name
Name of a service to stop
string
spooler
Attack Commandsrun with command_promptelevation required (root or admin)
sc.exe stop #{service_name}
Cleanup Commands
sc.exe start #{service_name} >nul 2>&1
GUID21dfb440-830d-4c86-a3e5-2a491d5a8d04
02
Windows - Stop service using net.exe
windows
command_prompt
Required
—
Yes
Stops a specified service using the net.exe command. Upon execution, if the service was running "The Print Spooler service was stopped successfully."
will be displayed. If the service was not running, "The Print Spooler service is not started." will be displayed and it can be
started by running the cleanup command.
Inputs
Name
Description
Type
Default Value
service_name
Name of a service to stop
string
spooler
Attack Commandsrun with command_promptelevation required (root or admin)
net.exe stop #{service_name}
Cleanup Commands
net.exe start #{service_name} >nul 2>&1
GUID41274289-ec9c-4213-bea4-e43c4aa57954
03
Windows - Stop service by killing process
windows
command_prompt
—
—
—
Stops a specified service killng the service's process.
This technique was used by WannaCry. Upon execution, if the spoolsv service was running "SUCCESS: The process "spoolsv.exe" with PID 2316 has been terminated."
will be displayed. If the service was not running "ERROR: The process "spoolsv.exe" not found." will be displayed and it can be
started by running the cleanup command.
Inputs
Name
Description
Type
Default Value
process_name
Name of a process to kill
string
spoolsv.exe
Attack Commandsrun with command_prompt
taskkill.exe /f /im #{process_name}
GUIDf3191b84-c38b-400b-867e-3a217a27795f
04
Linux - Stop service using systemctl
linux
sh
Required
—
Yes
Stops a specified service using the systemctl command.
Upon execution, if the specified service was running, it will change to a state of inactive and it can be restarted by running the cleanup command.
You can list all available services with following command: "systemctl list-units --type=service"
Inputs
Name
Description
Type
Default Value
service_name
Name of a service to stop
string
cron
Attack Commandsrun with shelevation required (root or admin)
sudo systemctl stop #{service_name}
Cleanup Commands
sudo systemctl start #{service_name} 2> /dev/null
GUID42e3a5bd-1e45-427f-aa08-2a65fa29a820
05
Linux - Stop service by killing process using killall
linux
sh
Required
—
Yes
Stops a specified service by sending a SIGTERM signal to the linked process using the killall command.
Upon execution, if the service's main process was running, it will be terminated.
If the service was not running, no process will be found to kill and it can be restarted by running the cleanup command.
You can list all available services with following command: "systemctl list-units --type=service"
Inputs
Name
Description
Type
Default Value
process_name
Name of a process to stop
string
cron
service_name
Name of a service to restart
string
cron
Attack Commandsrun with shelevation required (root or admin)
sudo killall -SIGTERM #{process_name}
Cleanup Commands
sudo systemctl start #{service_name} 2> /dev/null
GUIDe5d95be6-02ee-4ff1-aebe-cf86013b6189
06
Linux - Stop service by killing process using kill
linux
sh
Required
—
Yes
Stops a specified service by sending a SIGTERM signal to the linked process using the kill command. Upon execution, if the service's main process was running, it will be terminated.
If the service was not running, no process will be found to kill and it can be restarted by running the cleanup command.
You can list all available services with following command: "systemctl list-units --type=service"
Inputs
Name
Description
Type
Default Value
process_name
Name of a process to kill
string
cron
service_name
Name of a service to restart
string
cron
Attack Commandsrun with shelevation required (root or admin)
sudo kill -SIGTERM $(pgrep #{process_name})
Cleanup Commands
sudo systemctl start #{service_name} 2> /dev/null
GUID332f4c76-7e96-41a6-8cc2-7361c49db8be
07
Linux - Stop service by killing process using pkill
linux
sh
Required
—
Yes
Stops a specified service by sending a SIGTERM signal to the linked process using pkill. This method is effective when multiple instances of the process may be running.
Upon execution, if any instances of the process were running, they will be terminated. If no instances were running, pkill will not find any processes to kill.
Stopped service can be restarted by running the cleanup command.
You can list all available services with following command: "systemctl list-units --type=service"
Inputs
Name
Description
Type
Default Value
service_name
Name of a service to restart
string
cron
process_pattern
Pattern to match the name of the process to kill
string
^cron$
Attack Commandsrun with shelevation required (root or admin)
sudo pkill -SIGTERM #{process_pattern}
Cleanup Commands
sudo systemctl start #{service_name} 2> /dev/null
GUID08b4718f-a8bf-4bb5-a552-294fc5178fea
08
Abuse of linux magic system request key for Send a SIGTERM to all processes
linux
bash
Required
—
—
Adversaries with root or sufficient privileges Send a SIGTERM to all processes, except for init. By writing 'e' to /proc/sysrq-trigger, they can forced kill all processes, except for init.
Attack Commandsrun with bashelevation required (root or admin)
echo "e" > /proc/sysrq-trigger
GUID6e76f56f-2373-4a6c-a63f-98b7b72761f1
09
Windows - iisreset.exe to stop Internet services
windows
powershell
Required
1
Yes
Stops Internet services upon running. Used by BlackCat ransomware to release/prevent locks on files to be encrypted.
Attack Commandsrun with powershellelevation required (root or admin)
Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users.
The following analytic detects suspicious stopping of the `osquery` service, which may indicate an attempt to disable monitoring and evade detection. (...)
Detects potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to manipulate or destabilize a system. (...)
Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)
2023-03-05
2024-01-18
81bcb81b-5b1f-474b-b373-52c871aaa7b1
Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. (...)
The following analytic detects the stopping of the Windows Security Account Manager (SAM) service via command-line, typically using the "net stop samss" command. (...)
The following analytic detects the disabling of Windows Update services, such as "Update Orchestrator Service for Windows Update," "WaaSMedicSvc," and "Windows Update." It leverages Windows System Event ID 7040 logs to identify changes in service start modes to 'disabled.' This activity is significant as it can indicate an adversary's attempt to evade defenses by preventing critical updates, leaving the system vulnerable to exploits. (...)