MaxPatrol SIEM

Detects cyberincidents that undermine cyber resilience of a company

T1489: Service Stop

Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.

Adversaries may accomplish this by disabling individual services of high importance to an organization, such as MSExchangeIS, which will make Exchange content inaccessible . In some cases, adversaries may stop or disable many or all services to render systems unusable. Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct Data Destruction or Data Encrypted for Impact on the data stores of services like Exchange and SQL Server.

Positive Technologies products that cover the technique

MaxPatrol SIEM knowledge base

grafana_labs: PT-CR-2328: Grafana_Plugin_Stopped: A plugin was stopped in Grafana. An attacker can disable Grafana by stopping critical modules.
mitre_attck_impact: PT-CR-501: Stop_Important_Service: Attempt to stop an important service
mitre_attck_impact: PT-CR-502: Stop_Important_Service_registry: Detection of attempts to stop an important service. The list of services is in the table list Significant_services.
monitoring: PT-CR-9: Network_service_inaccessibility: Service is down
monitoring: PT-CR-12: Unix_service_unavailability: Service is down
mssql_database: PT-CR-425: MSSQL_Windows_service_control: An attempt to change a Windows service state from a database

Detection

IDDS0009Data source and componentProcess: Process TerminationDescription

Monitor processes and command-line arguments to see if critical processes are terminated or stop running.

IDDS0019Data source and componentService: Service MetadataDescription

Alterations to the service binary path or the service startup type changed to disabled may be suspicious.

IDDS0009Data source and componentProcess: Process CreationDescription

Monitor for newly executed processes that may stop or disable services on a system to render those services unavailable to legitimate users.

IDDS0009Data source and componentProcess: OS API ExecutionDescription

Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. For example, ChangeServiceConfigW may be used by an adversary to prevent services from starting.

IDDS0024Data source and componentWindows Registry: Windows Registry Key ModificationDescription

Monitor for changes made to windows registry keys and/or values that may stop or disable services on a system to render those services unavailable to legitimate users.

IDDS0017Data source and componentCommand: Command ExecutionDescription

Monitor executed commands and arguments that may stop or disable services on a system to render those services unavailable to legitimate users.

IDDS0022Data source and componentFile: File ModificationDescription

Monitor for changes made to files that may stop or disable services on a system to render those services unavailable to legitimate users.

Mitigation

IDM1030NameNetwork SegmentationDescription

Operate intrusion detection, analysis, and response systems on a separate network from the production environment to lessen the chances that an adversary can see and interfere with critical response functions.

IDM1018NameUser Account ManagementDescription

Limit privileges of user accounts and groups so that only authorized administrators can interact with service changes and service configurations.

IDM1024NameRestrict Registry PermissionsDescription

Ensure proper registry permissions are in place to inhibit adversaries from disabling or interfering with critical services.

IDM1022NameRestrict File and Directory PermissionsDescription

Ensure proper process and file permissions are in place to inhibit adversaries from disabling or interfering with critical services.