T1668 · persistence · ATT&CK 19.1

Exclusive Control

Adversaries who successfully compromise a system may attempt to maintain persistence by “closing the door” behind them – in other words, by preventing other threat actors from initially accessing or maintaining a foothold on the same system. For example, adversaries may patch a vulnerable, compromised system(Citation: Mandiant-iab-control)(Citation: CERT AT Fortinent Ransomware 2025) to prevent other threat actors from leveraging that vulnerability in the future. They may “close the door” in other ways, such as disabling vulnerable services(Citation: sophos-multiple-attackers), stripping privileges from accounts(Citation: aquasec-postgres-processes), or removing other malware already on the compromised device.(Citation: fsecure-netsky) Hindering other threat actors may allow an adversary to maintain sole access to a compromised system or network. This prevents the threat actor from needing to compete with or even being removed themselves by other threat actors. It also reduces the “noise” in the environment, lowering the possibility of being caught and evicted by defenders. Finally, in the case of [Resource Hijacking](https://attack.mitre.org/techniques/T1496), leveraging a compromised device’s full power allows the threat actor to maximize profit.(Citation: sophos-multiple-attackers)

Open in the interactive knowledge mesh

Detection overview

Use the published detection strategies below and validate required telemetry in the target environment.

Observed groups

No current Enterprise group relationship is published in this bundle.

Cyber Knowledge context

Use these routes to move from the ATT&CK behavior into explanation, implementation, evidence handling, validation, and defensive operations. Relevance is generated from explicit identifiers/names and governed topic mappings; it is not attribution evidence.

Frameworks, profiles, baselines, and crosswalk discipline
Governance, Risk & Compliance (GRC) · topic-match · 39/100Evidence engineering, control testing, audit, and assurance
Governance, Risk & Compliance (GRC) · topic-match · 39/100Metrics, KRIs, reporting, and maturity without vanity scores
Governance, Risk & Compliance (GRC) · topic-match · 39/100Module 5 — Cloud, containers, and Kubernetes
Red Team & Offensive Security · tactic-route · 24/100Module 4 — Detection engineering and detection as code
Blue Team & Defensive Security · tactic-route · 24/100Disk, file-system, and persistence forensics
Digital Forensics & Incident Response (DFIR) · tactic-route · 24/100

MITRE mitigations

No ATT&CK mitigation relationship is published for this technique. Apply risk-based controls and verify scope.

MITRE detection strategies and analytics

DET0015 · Detection Strategy for Exclusive Control
  • AN0045 · Analytic 0045 — Detects unusual command executions and service modifications that indicate self-patching or disabling of vulnerable services post-compromise. Defenders should monitor for service stop commands, suspicious process termination, and execution of binaries or scripts aligned with known patching or service management tools outside of expected admin contexts.
  • AN0046 · Analytic 0046 — Detects adversary attempts to monopolize control of compromised systems by issuing service stop commands, unloading vulnerable modules, or forcefully killing competing processes. Defenders should monitor audit logs and syslog for administrative utilities (systemctl, service, kill) being invoked outside of normal change management.
  • AN0047 · Analytic 0047 — Detects unauthorized termination of system daemons or commands issued through launchctl or kill to stop competing services or malware processes. Defenders should monitor unified logs and EDR telemetry for unusual service modifications or terminations.
MITRE detection source