| Item |
Value |
| ID |
DET0021 |
| Version |
1.0 |
| Created |
21 October 2025 |
| Last Modified |
21 October 2025 |
Technique Detected: T1489 (Service Stop)
Analytics
Windows
AN0061
Adversary disables or stops critical services (e.g., Exchange, SQL, AV, endpoint monitoring) using native utilities or API calls, often preceding destructive actions (T1485, T1486). Behavioral chain: Elevated execution context + stop-service or sc.exe or ChangeServiceConfigW + terminated or disabled service + possible follow-up file manipulation.
Log Sources
Mutable Elements
| Field |
Description |
| TimeWindow |
Time span between elevated privilege use and critical service stop |
| ServiceName |
Service names of interest (e.g., MSExchangeIS, SQLSERVERAGENT) |
| ParentProcess |
Upstream process lineage leading to service stop |
Linux
AN0062
Adversary executes systemctl or service stop targeting high-value services (e.g., mysql, sshd), possibly followed by rm or shred against data stores. Behavioral chain: sudo/su usage + stop command + /var/log/messages or syslog entries + file access/delete.
Log Sources
Mutable Elements
| Field |
Description |
| TimeWindow |
Window between service stop and suspicious file deletion |
| ExecUser |
Username or UID executing service stop command |
macOS
AN0063
Use of launchctl to stop services or kill critical background processes (e.g., securityd, com.apple.*), typically followed by command-line tools like rm or diskutil. Behavioral chain: Terminal or remote shell + launchctl bootout/disable + process termination + follow-on modification.
Log Sources
Mutable Elements
| Field |
Description |
| ServiceLabel |
Launch daemon label or name targeted by command |
| LaunchType |
Whether the command disables or boots out the service |
ESXi
AN0064
Attacker disables VM-related services or stops VMs forcibly to target vmdk or logs. Behavioral chain: esxcli or vim-cmd stop + audit log showing user privilege use + datastore file manipulation.
Log Sources
Mutable Elements
| Field |
Description |
| VMName |
Targeted virtual machine name |
| InitiatorUser |
User who issued stop or disable command |