Skip to content

T1489 Service Stop

Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary’s overall objectives to cause damage to the environment.23

Adversaries may accomplish this by disabling individual services of high importance to an organization, such as MSExchangeIS, which will make Exchange content inaccessible 3. In some cases, adversaries may stop or disable many or all services to render systems unusable.2 Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct Data Destruction or Data Encrypted for Impact on the data stores of services like Exchange and SQL Server.1

Item Value
ID T1489
Sub-techniques
Tactics TA0040
Platforms Linux, Windows, macOS
Version 1.2
Created 29 March 2019
Last Modified 28 July 2022

Procedure Examples

ID Name Description
S0640 Avaddon Avaddon looks for and attempts to stop database processes.25
S1053 AvosLocker AvosLocker has terminated specific processes before encryption.14
S0638 Babuk Babuk can stop specific services related to backups.202122
S1068 BlackCat BlackCat has the ability to stop VM services on compromised networks.1716
S0611 Clop Clop can kill several processes and services related to backups and security solutions.1213
S0575 Conti Conti can stop up to 146 Windows services related to security, backup, database, and email solutions through the use of net stop.37
S0625 Cuba Cuba has a hardcoded list of services and processes to terminate.29
S0659 Diavol Diavol will terminate services using the Service Control Manager (SCM) API.28
S0605 EKANS EKANS stops database, data backup solution, antivirus, and ICS-related processes.333435
S0697 HermeticWiper HermeticWiper has the ability to stop the Volume Shadow Copy service.6
S0431 HotCroissant HotCroissant has the ability to stop services on the infected host.15
G0119 Indrik Spider Indrik Spider has used PsExec to stop services prior to the execution of ransomware.39
S0604 Industroyer Industroyer’s data wiper module writes zeros into the registry keys in SYSTEM\CurrentControlSet\Services to render a system inoperable.31
S0607 KillDisk KillDisk terminates various processes to get the user to reboot the victim machine.26
G0032 Lazarus Group Lazarus Group has stopped the MSExchangeIS service to render Exchange contents inaccessible to users.40
S0582 LookBack LookBack can kill processes and delete services.38
S0449 Maze Maze has stopped SQL services to ensure it can encrypt any database.24
S0576 MegaCortex MegaCortex can stop and disable services on the system.36
S0688 Meteor Meteor can disconnect all network adapters on a compromised host using powershell -Command "Get-WmiObject -class Win32_NetworkAdapter | ForEach { If ($.NetEnabled) { $.Disable() } }" > NUL.4
S0457 Netwalker Netwalker can terminate system processes and services, some of which relate to backup software.19
S0365 Olympic Destroyer Olympic Destroyer uses the API call ChangeServiceConfigW to disable all services on the affected system.2
S0556 Pay2Key Pay2Key can stop the MS SQL service at the end of the encryption process to release files locked by the service.7
S1058 Prestige Prestige has attempted to stop the MSSQL Windows service to ensure successful encryption using C:\Windows\System32\net.exe stop MSSQLSERVER.18
S0583 Pysa Pysa can stop services and processes.30
S0481 Ragnar Locker Ragnar Locker has attempted to stop services associated with business applications and databases to release the lock on files used by these applications so they may be encrypted.9
S0496 REvil REvil has the capability to stop services and kill processes.1011
S0400 RobbinHood RobbinHood stops 181 Windows services on the system before beginning the encryption process.5
S1073 Royal Royal can use RmShutDown to kill applications and services using the resources that are targeted for encryption.27
S0446 Ryuk Ryuk has called kill.bat for stopping services, disabling services and killing processes.32
S0533 SLOTHFULMEDIA SLOTHFULMEDIA has the capability to stop processes and services.23
S0366 WannaCry WannaCry attempts to kill processes associated with Exchange, Microsoft SQL Server, and MySQL to make it possible to encrypt their data stores.81
G0102 Wizard Spider Wizard Spider has used taskkill.exe and net.exe to stop backup, catalog, cloud, and other services prior to network encryption.41

Mitigations

ID Mitigation Description
M1030 Network Segmentation Operate intrusion detection, analysis, and response systems on a separate network from the production environment to lessen the chances that an adversary can see and interfere with critical response functions.
M1022 Restrict File and Directory Permissions Ensure proper process and file permissions are in place to inhibit adversaries from disabling or interfering with critical services.
M1024 Restrict Registry Permissions Ensure proper registry permissions are in place to inhibit adversaries from disabling or interfering with critical services.
M1018 User Account Management Limit privileges of user accounts and groups so that only authorized administrators can interact with service changes and service configurations.

Detection

ID Data Source Data Component
DS0017 Command Command Execution
DS0022 File File Modification
DS0009 Process OS API Execution
DS0019 Service Service Metadata
DS0024 Windows Registry Windows Registry Key Modification

References

  1. Counter Threat Unit Research Team. (2017, May 18). WCry Ransomware Analysis. Retrieved March 26, 2019. ↩↩

  2. Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019. ↩↩↩

  3. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016. ↩↩

  4. Check Point Research Team. (2021, August 14). Indra - Hackers Behind Recent Attacks on Iran. Retrieved February 17, 2022. ↩

  5. Lee, S. (2019, May 17). CB TAU Threat Intelligence Notification: RobbinHood Ransomware Stops 181 Windows Services Before Encryption. Retrieved July 29, 2019. ↩

  6. Dani, M. (2022, March 1). Ukrainian Targets Hit by HermeticWiper, New Datawiper Malware. Retrieved March 25, 2022. ↩

  7. Check Point. (2020, November 6). Ransomware Alert: Pay2Key. Retrieved January 4, 2021. ↩

  8. Berry, A., Homan, J., and Eitzman, R. (2017, May 23). WannaCry Malware Profile. Retrieved March 15, 2019. ↩

  9. SophosLabs. (2020, May 21). Ragnar Locker ransomware deploys virtual machine to dodge security. Retrieved June 29, 2020. ↩

  10. Intel 471 Malware Intelligence team. (2020, March 31). REvil Ransomware-as-a-Service – An analysis of a ransomware affiliate operation. Retrieved August 4, 2020. ↩

  11. Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020. ↩

  12. Santos, D. (2021, April 13). Threat Assessment: Clop Ransomware. Retrieved July 30, 2021. ↩

  13. Mundo, A. (2019, August 1). Clop Ransomware. Retrieved May 10, 2021. ↩

  14. Hasherezade. (2021, July 23). AvosLocker enters the ransomware scene, asks for partners. Retrieved January 11, 2023. ↩

  15. Knight, S.. (2020, April 16). VMware Carbon Black TAU Threat Analysis: The Evolution of Lazarus. Retrieved May 1, 2020. ↩

  16. Brandt, Andrew. (2022, July 14). BlackCat ransomware attacks not merely a byproduct of bad luck. Retrieved December 20, 2022. ↩

  17. Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022. ↩

  18. MSTIC. (2022, October 14). New “Prestige” ransomware impacts organizations in Ukraine and Poland. Retrieved January 19, 2023. ↩

  19. Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020. ↩

  20. Sogeti. (2021, March). Babuk Ransomware. Retrieved August 11, 2021. ↩

  21. Mundo, A. et al. (2021, February). Technical Analysis of Babuk Ransomware. Retrieved August 11, 2021. ↩

  22. Centero, R. et al. (2021, February 5). New in Ransomware: Seth-Locker, Babuk Locker, Maoloa, TeslaCrypt, and CobraLocker. Retrieved August 11, 2021. ↩

  23. DHS/CISA, Cyber National Mission Force. (2020, October 1). Malware Analysis Report (MAR) MAR-10303705-1.v1 – Remote Access Trojan: SLOTHFULMEDIA. Retrieved October 2, 2020. ↩

  24. Brandt, A., Mackenzie, P.. (2020, September 17). Maze Attackers Adopt Ragnar Locker Virtual Machine Technique. Retrieved October 9, 2020. ↩

  25. Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021. ↩

  26. Gilbert Sison, Rheniel Ramos, Jay Yaneza, Alfredo Oliveira. (2018, January 15). KillDisk Variant Hits Latin American Financial Groups. Retrieved January 12, 2021. ↩

  27. Cybereason Global SOC and Cybereason Security Research Teams. (2022, December 14). Royal Rumble: Analysis of Royal Ransomware. Retrieved March 30, 2023. ↩

  28. Neeamni, D., Rubinfeld, A.. (2021, July 1). Diavol - A New Ransomware Used By Wizard Spider?. Retrieved November 12, 2021. ↩

  29. Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021. ↩

  30. CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021. ↩

  31. Dragos Inc.. (2017, June 13). CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations. Retrieved December 18, 2020. ↩

  32. Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020. ↩

  33. Dragos. (2020, February 3). EKANS Ransomware and ICS Operations. Retrieved February 9, 2021. ↩

  34. Zafra, D., et al. (2020, February 24). Ransomware Against the Machine: How Adversaries are Learning to Disrupt Industrial Production by Targeting IT and OT. Retrieved March 2, 2021. ↩

  35. Hinchliffe, A. Santos, D. (2020, June 26). Threat Assessment: EKANS Ransomware. Retrieved February 9, 2021. ↩

  36. Del Fierro, C. Kessem, L.. (2020, January 8). From Mega to Giga: Cross-Version Comparison of Top MegaCortex Modifications. Retrieved February 15, 2021. ↩

  37. Baskin, B. (2020, July 8). TAU Threat Discovery: Conti Ransomware. Retrieved February 17, 2021. ↩

  38. Raggi, M. Schwarz, D.. (2019, August 1). LookBack Malware Targets the United States Utilities Sector with Phishing Attacks Impersonating Engineering Licensing Boards. Retrieved February 25, 2021. ↩

  39. Symantec Threat Intelligence. (2020, June 25). WastedLocker: Symantec Identifies Wave of Attacks Against U.S. Organizations. Retrieved May 20, 2021. ↩

  40. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Destructive Malware Report. Retrieved March 2, 2016. ↩

  41. The DFIR Report. (2020, October 8). Ryuk’s Return. Retrieved October 9, 2020. ↩