tfMITRE ATT&CK technique

Service Stop T1489

Tactic: Impact
Platforms: ESXi, IaaS, Linux, macOS, Windows
Version: 1.4
Created: 29 March 2019
Last modified: 12 May 2026
Contributor: Liran Ravich, CardinalOps

Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.[1][2]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 23%

Threat groups77th percentile · 77% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 8%

Tools & malware92nd percentile · 92% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 6%

Detection rules94th percentile · 94% of ATT&CK techniques have this many detection rules written or fewer.

Service Stop MITRE reference T1489

Top 23%of all ATT&CK techniques for number of groups

7 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Medusa GroupG1051 ↗

Has terminated services related to backups, security, databases, communication, filesharing and websites.1 2 3

created 2025-10-153 references

LAPSUS$G1004 ↗

Has shut down virtual machines from within a victim's on-premise VMware ESXi infrastructure.1

created 2022-06-091 referenceaka DEV-0537

Indrik SpiderG0119 ↗

Has used PsExec to stop services prior to the execution of ransomware.1

created 2021-01-061 referenceaka Evil Corp

Wizard SpiderG0102 ↗

Has used taskkill.exe and net.exe to stop backup, catalog, cloud, and other services prior to network encryption.1

created 2020-05-121 referenceaka UNC1878

KimsukyG0094 ↗

Has disabled actively running virtual environments using the KillMe function to include VMware, Microsoft Hypervisors, and VirtualBox.1

created 2019-08-261 referenceaka Black Banshee

Sandworm TeamG0034 ↗

Attempts to stop the MSSQL Windows service to ensure successful encryption of locked files.1

created 2017-05-311 referenceaka ELECTRUM

All 7 groups for this technique · 6 newest in this preview

47 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

BRICKSTORMS9015 ↗

Has terminated an existing process to ensure that its own new process can execute.1

created 2026-04-16MALWARE

PHASEJAMS9014 ↗

Has disabled the cgi-server process on Ivanti Connect Secure appliances.1

created 2026-04-16MALWARE

DRYHOOKS9013 ↗

Has terminated all instances of the cgi-server process before activating the modified DSAuth.pm file.1

created 2026-04-14MALWARE

EmbargoS1247 ↗

Has terminated active processes and services based on a hardcoded list using the CloseServiceHandle() function.1 Embargo has also leveraged MS4Killer to terminate processes contained in an embedded list of security software process names that were XOR-encrypted.2

created 2025-10-19MALWAREcarried by 1 group

InvisibleFerretS1245 ↗

Has terminated Chrome and Brave browsers using the taskkill command on Windows and the killall command on other systems such as Linux and macOS.1 InvisibleFerret has also utilized it’s ssh_kill command to terminate Chrome and Brave browser processes.2

created 2025-10-17MALWAREcarried by 1 group

Medusa RansomwareS1244 ↗

Has the capability to terminate services related to backups, security, databases, communication, filesharing and websites.1 2 3 Medusa Ransomware has also utilized the taskkill /F /IM <process> /T command to stop targeted processes and net stop <process> command to stop designated services.2 3

created 2025-10-17MALWAREcarried by 1 group

All 47 software entries for this technique · 6 newest in this preview

Offense vs defense T1489

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 20Splunk ESCU (cumulative) · 17

first rule: 2020 Q4

Service Stop detection strategy DET0021

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavioral Detection for Service Stop across Platforms

Enterprise

4 platforms

AN0061 · Windows

Adversary disables or stops critical services (e.g., Exchange, SQL, AV, endpoint monitoring) using native utilities or API calls, often preceding destructive actions (T1485, T1486). Behavioral chain: Elevated execution context + stop-service or sc.exe or ChangeServiceConfigW + terminated or disabled service + possible follow-up file manipulation.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Service MetadataDC0041	WinEventLog:Sysmon	EventCode=4
Service CreationDC0060	WinEventLog:System	EventCode=7036
Logon Session MetadataDC0088	WinEventLog:Security	EventCode=4672

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Time span between elevated privilege use and critical service stop
ServiceName	Service names of interest (e.g., MSExchangeIS, SQLSERVERAGENT)
ParentProcess	Upstream process lineage leading to service stop

AN0062 · Linux

Adversary executes systemctl or service stop targeting high-value services (e.g., mysql, sshd), possibly followed by rm or shred against data stores. Behavioral chain: sudo/su usage + stop command + /var/log/messages or syslog entries + file access/delete.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve of systemctl or service stop
File DeletionDC0040	auditd:SYSCALL	unlink/unlinkat on service binaries or data targets
Service MetadataDC0041	linux:syslog	service stopped messages

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Window between service stop and suspicious file deletion
ExecUser	Username or UID executing service stop command

AN0063 · macOS

Use of launchctl to stop services or kill critical background processes (e.g., securityd, com.apple.*), typically followed by command-line tools like rm or diskutil. Behavioral chain: Terminal or remote shell + launchctl bootout/disable + process termination + follow-on modification.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve of launchctl or pkill
Service MetadataDC0041	macos:unifiedlog	launchctl disable or bootout calls

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ServiceLabel	Launch daemon label or name targeted by command
LaunchType	Whether the command disables or boots out the service

AN0064 · ESXi

Attacker disables VM-related services or stops VMs forcibly to target vmdk or logs. Behavioral chain: esxcli or vim-cmd stop + audit log showing user privilege use + datastore file manipulation.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process TerminationDC0033	esxi:hostd	Log entries indicating VM powered off or forcibly terminated
Service MetadataDC0041	esxi:hostd	Stop VM or disable service events via vim-cmd

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
VMName	Targeted virtual machine name
InitiatorUser	User who issued stop or disable command

Tests8Executorssh 4 · cmd 3 · bash 1Need elevation7 of 8Have prerequisites0Have cleanup6Platformswindows, linux

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Windows - Stop service using Service Controller

windows

cmd

Required

—

Yes

Stops a specified service using the sc.exe command. Upon execution, if the spooler service was running infomration will be displayed saying it has changed to a state of STOP_PENDING. If the spooler service was not running "The service has not been started." will be displayed and it can be started by running the cleanup command.

Input arguments

Name	Type	Default	Description
service_name	string	spooler	Name of a service to stop

Attack command

sc.exe stop #{service_name}

Cleanup command

sc.exe start #{service_name} >nul 2>&1

GUID85e63310-dbd1-4fe3-8c82-4b2f372079ab

Windows - Stop service using net.exe

windows

cmd

Required

—

Yes

Stops a specified service using the net.exe command. Upon execution, if the service was running "The Print Spooler service was stopped successfully." will be displayed. If the service was not running, "The Print Spooler service is not started." will be displayed and it can be started by running the cleanup command.

Input arguments

Name	Type	Default	Description
service_name	string	spooler	Name of a service to stop

Attack command

net.exe stop #{service_name}

Cleanup command

net.exe start #{service_name} >nul 2>&1

GUID36d502b2-29b9-412b-8377-f1d58238bc09

Windows - Stop service by killing process

windows

cmd

—

Stops a specified service killng the service's process. This technique was used by WannaCry. Upon execution, if the spoolsv service was running "SUCCESS: The process "spoolsv.exe" with PID 2316 has been terminated." will be displayed. If the service was not running "ERROR: The process "spoolsv.exe" not found." will be displayed and it can be started by running the cleanup command.

Input arguments

Name	Type	Default	Description
process_name	string	spoolsv.exe	Name of a process to kill

Attack command

taskkill.exe /f /im #{process_name}

GUIDaff2911a-3c14-4270-a725-3fda7eed8e6e

Linux - Stop service using systemctl

linux

Required

—

Yes

Stops a specified service using the systemctl command. Upon execution, if the specified service was running, it will change to a state of inactive and it can be restarted by running the cleanup command. You can list all available services with following command: "systemctl list-units --type=service"

Input arguments

Name	Type	Default	Description
service_name	string	cron	Name of a service to stop

Attack command

sudo systemctl stop #{service_name}

Cleanup command

sudo systemctl start #{service_name} 2> /dev/null

GUID28fc6043-e438-45bf-b178-22f0584bfee2

Linux - Stop service by killing process using killall

linux

Required

—

Yes

Stops a specified service by sending a SIGTERM signal to the linked process using the killall command. Upon execution, if the service's main process was running, it will be terminated. If the service was not running, no process will be found to kill and it can be restarted by running the cleanup command. You can list all available services with following command: "systemctl list-units --type=service"

Input arguments

Name	Type	Default	Description
process_name	string	cron	Name of a process to stop
service_name	string	cron	Name of a service to restart

Attack command

sudo killall -SIGTERM #{process_name}

Cleanup command

sudo systemctl start #{service_name} 2> /dev/null

GUID13e3c92e-9465-4b1e-8144-c3562972b35a

Linux - Stop service by killing process using kill

linux

Required

—

Yes

Stops a specified service by sending a SIGTERM signal to the linked process using the kill command. Upon execution, if the service's main process was running, it will be terminated. If the service was not running, no process will be found to kill and it can be restarted by running the cleanup command. You can list all available services with following command: "systemctl list-units --type=service"

Input arguments

Name	Type	Default	Description
process_name	string	cron	Name of a process to kill
service_name	string	cron	Name of a service to restart

Attack command

sudo kill -SIGTERM $(pgrep #{process_name})

Cleanup command

sudo systemctl start #{service_name} 2> /dev/null

GUID1e58d250-3b8a-40b8-a7c5-3a7419966f33

Linux - Stop service by killing process using pkill

linux

Required

—

Yes

Stops a specified service by sending a SIGTERM signal to the linked process using pkill. This method is effective when multiple instances of the process may be running. Upon execution, if any instances of the process were running, they will be terminated. If no instances were running, pkill will not find any processes to kill. Stopped service can be restarted by running the cleanup command. You can list all available services with following command: "systemctl list-units --type=service"

Input arguments

Name	Type	Default	Description
service_name	string	cron	Name of a service to restart
process_pattern	string	^cron$	Pattern to match the name of the process to kill

Attack command

sudo pkill -SIGTERM #{process_pattern}

Cleanup command

sudo systemctl start #{service_name} 2> /dev/null

GUIDff641139-7816-45df-867b-bd1d2393b004

Abuse of linux magic system request key for Send a SIGTERM to all processes

linux

bash

Required

—

Tests from Atomic Red Team (MIT licence) · technique definition

Service Stop detections T1489

37 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 6%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs