T1489
Service Stop
Description from ATT&CK
Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster)
Adversaries may accomplish this by disabling individual services of high importance to an organization, such as MSExchangeIS, which will make Exchange content inaccessible (Citation: Novetta Blockbuster). In some cases, adversaries may stop or disable many or all services to render systems unusable.(Citation: Talos Olympic Destroyer 2018) Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct Data Destruction or Data Encrypted for Impact on the data stores of services like Exchange and SQL Server.(Citation: SecureWorks WannaCry Analysis)
Atomic Tests
Atomic Test #1 - Windows - Stop service using Service Controller
Stops a specified service using the sc.exe command. Upon execution, if the spooler service was running infomration will be displayed saying it has changed to a state of STOP_PENDING. If the spooler service was not running "The service has not been started." will be displayed and it can be started by running the cleanup command.
Supported Platforms: windows
auto_generated_guid: 21dfb440-830d-4c86-a3e5-2a491d5a8d04
Inputs:
| Name | Description | Type | Default Value |
|---|---|---|---|
| service_name | Name of a service to stop | string | spooler |
Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)
1
2
sc.exe stop #{service_name}
Cleanup Commands:
1
2
sc.exe start #{service_name} >nul 2>&1
Atomic Test #2 - Windows - Stop service using net.exe
Stops a specified service using the net.exe command. Upon execution, if the service was running "The Print Spooler service was stopped successfully." will be displayed. If the service was not running, "The Print Spooler service is not started." will be displayed and it can be started by running the cleanup command.
Supported Platforms: windows
auto_generated_guid: 41274289-ec9c-4213-bea4-e43c4aa57954
Inputs:
| Name | Description | Type | Default Value |
|---|---|---|---|
| service_name | Name of a service to stop | string | spooler |
Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)
1
2
net.exe stop #{service_name}
Cleanup Commands:
1
2
net.exe start #{service_name} >nul 2>&1
Atomic Test #3 - Windows - Stop service by killing process
Stops a specified service killng the service's process. This technique was used by WannaCry. Upon execution, if the spoolsv service was running "SUCCESS: The process "spoolsv.exe" with PID 2316 has been terminated." will be displayed. If the service was not running "ERROR: The process "spoolsv.exe" not found." will be displayed and it can be started by running the cleanup command.
Supported Platforms: windows
auto_generated_guid: f3191b84-c38b-400b-867e-3a217a27795f
Inputs:
| Name | Description | Type | Default Value |
|---|---|---|---|
| process_name | Name of a process to kill | string | spoolsv.exe |
Attack Commands: Run with command_prompt!
1
2
taskkill.exe /f /im #{process_name}