tfMITRE ATT&CK technique

Exclusive Control T1668

Tactic: Persistence
Platforms: Linux, macOS, Windows
Version: 1.0
Created: 31 January 2025
Last modified: 15 April 2025
Contributor: Menachem Goldstein

Adversaries who successfully compromise a system may attempt to maintain persistence by “closing the door” behind them – in other words, by preventing other threat actors from initially accessing or maintaining a foothold on the same system.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Offense vs defense T1668

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Exclusive Control detection strategy DET0015

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Exclusive Control

Enterprise

3 platforms

AN0045 · Windows

Detects unusual command executions and service modifications that indicate self-patching or disabling of vulnerable services post-compromise. Defenders should monitor for service stop commands, suspicious process termination, and execution of binaries or scripts aligned with known patching or service management tools outside of expected admin contexts.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Process TerminationDC0033	WinEventLog:Sysmon	EventCode=5

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ServiceList	Tunable list of critical or vulnerable services that defenders want to monitor for unexpected disabling.
TimeWindow	Defines correlation window (e.g., 5–15 minutes) between suspicious command execution and subsequent process termination.

AN0046 · Linux

Detects adversary attempts to monopolize control of compromised systems by issuing service stop commands, unloading vulnerable modules, or forcefully killing competing processes. Defenders should monitor audit logs and syslog for administrative utilities (systemctl, service, kill) being invoked outside of normal change management.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process TerminationDC0033	linux:syslog	Unexpected termination of daemons or critical services not aligned with admin change tickets
Command ExecutionDC0064	auditd:SYSCALL	execve: Commands like systemctl stop <service>, service <service> stop, or kill -9 <pid>

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CriticalProcessList	Defines specific Linux daemons and processes that should not be terminated outside maintenance windows.
AdminUserContext	Defines expected accounts permitted to execute service stop commands; deviations may be suspicious.

AN0047 · macOS

Detects unauthorized termination of system daemons or commands issued through launchctl or kill to stop competing services or malware processes. Defenders should monitor unified logs and EDR telemetry for unusual service modifications or terminations.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process TerminationDC0033	macos:osquery	process_termination: Unexpected termination of processes tied to vulnerable or high-value services
Command ExecutionDC0064	macos:unifiedlog	launchctl unload, kill, or pkill commands affecting daemons or background services

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ProtectedServiceList	Defines macOS services (e.g., securityd, keychain-related daemons) that should never be disabled.

Exclusive Control detections T1668

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs