{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1489","id":"T1489","name":"Service Stop","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1489","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"951bf68ed502c30af4fdbdfc01e975d3e981732ef46d1cb77621150830a85b31","description":"Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster) \n\nAdversaries may accomplish this by disabling individual services of high importance to an organization, such as <code>MSExchangeIS</code>, which will make Exchange content inaccessible.(Citation: Novetta Blockbuster) In some cases, adversaries may stop or disable many or all services to render systems unusable.(Citation: Talos Olympic Destroyer 2018) Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct [Data Destruction](https://attack.mitre.org/techniques/T1485) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) on the data stores of services like Exchange and SQL Server, or on virtual machines hosted on ESXi infrastructure.(Citation: SecureWorks WannaCry Analysis)(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)\n\nThreat actors may also disable or stop service in cloud environments. For example, by leveraging the `DisableAPIServiceAccess` API in AWS, a threat actor may prevent the service from creating service-linked roles on new accounts in the AWS Organization.(Citation: Datadog Security Labs Cloud Persistence 2025)(Citation: AWS DisableAWSServiceAccess)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1489","external_id":"T1489"},{"source_name":"AWS DisableAWSServiceAccess","description":"AWS. (n.d.). DisableAWSServiceAccess. Retrieved May 22, 2025.","url":"https://docs.aws.amazon.com/organizations/latest/APIReference/API_DisableAWSServiceAccess.html"},{"source_name":"SecureWorks WannaCry Analysis","description":"Counter Threat Unit Research Team. (2017, May 18). WCry Ransomware Analysis. Retrieved March 26, 2019.","url":"https://www.secureworks.com/research/wcry-ransomware-analysis"},{"source_name":"Datadog Security Labs Cloud Persistence 2025","description":"Martin McCloskey. (2025, May 13). Tales from the cloud trenches: The Attacker doth persist too much, methinks. Retrieved May 22, 2025.","url":"https://securitylabs.datadoghq.com/articles/tales-from-the-cloud-trenches-the-attacker-doth-persist-too-much/"},{"source_name":"Talos Olympic Destroyer 2018","description":"Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.","url":"https://blog.talosintelligence.com/2018/02/olympic-destroyer.html"},{"source_name":"Crowdstrike Hypervisor Jackpotting Pt 2 2021","description":"Michael Dawson. (2021, August 30). Hypervisor Jackpotting, Part 2: eCrime Actors Increase Targeting of ESXi Servers with Ransomware. Retrieved March 26, 2025.","url":"https://www.crowdstrike.com/en-us/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/"},{"source_name":"Novetta Blockbuster","description":"Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}],"platforms":["ESXi","IaaS","Linux","macOS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0040","name":"File Deletion","page":"telemetry/DC0040/","kind":"attack_component","category":"Endpoint activity","description":"Deletion of a file, with path and responsible process where available.","collection_focus":"Prefer Sysmon FileDeleteDetected (26) when content retention is not needed; FileDelete (23) also archives files and requires a storage/privacy plan.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","path","action","archived"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0040","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"delete","archived":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0088","name":"Logon Session Metadata","page":"telemetry/DC0088/","kind":"attack_component","category":"Host state and inventory","description":"Attributes of existing logon sessions and their association with accounts or hosts.","collection_focus":"Collect supported session inventory and correlate session IDs with authentication, logon and logoff events.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["session_id","account","host","session_type"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0088","collector":"illustrative-lab-collector","observation":{"session_id":"lab-session-1","account":"LAB\\analyst","host":"lab-host-1","session_type":"interactive"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0033","name":"Process Termination","page":"telemetry/DC0033/","kind":"attack_component","category":"Endpoint activity","description":"Termination of a process, correlated to its earlier creation.","collection_focus":"Collect Sysmon ProcessTerminate (5) and join on ProcessGuid; do not assume every provider records an exit code.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","process_id","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0033","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","process_id":4200,"action":"terminate"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0060","name":"Service Creation","page":"telemetry/DC0060/","kind":"attack_component","category":"Windows and directory audit","description":"Installation or registration of a service.","collection_focus":"Collect service-install auditing through Audit Security System Extension where supported, plus Service Control Manager/System logs and the new service configuration.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["service","action","executable","actor"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0060","collector":"illustrative-lab-collector","observation":{"service":"LabService","action":"install","executable":"C:\\Lab\\service.exe","actor":"lab-admin"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0041","name":"Service Metadata","page":"telemetry/DC0041/","kind":"attack_component","category":"Host state and inventory","description":"Service configuration and current state at observation time.","collection_focus":"Inventory service name, executable, startup mode, owner and status using supported OS APIs; compare successive snapshots.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["service","executable","start_mode","state"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0041","collector":"illustrative-lab-collector","observation":{"service":"LabService","executable":"C:\\Lab\\service.exe","start_mode":"manual","state":"stopped"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."}],"detection":{"key":"enterprise/T1489","id":"T1489","name":"Service Stop","domain":"enterprise","platforms":["ESXi","IaaS","Linux","macOS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1489","technique_page":"techniques/enterprise/T1489/","page":"detections/enterprise/T1489/","status":"rule_source_available","counts":{"sigma":19,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[{"id":"410d2a41-1e6d-452f-85e5-abdd8257a823","title":"Azure Application Deleted","status":"test","level":"medium","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/410d2a41-1e6d-452f-85e5-abdd8257a823.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_application_deleted.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"93e0ef48-37c8-49ed-a02c-038aab23628e","title":"Azure Container Registry Created or Deleted","status":"test","level":"low","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/93e0ef48-37c8-49ed-a02c-038aab23628e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_container_registry_created_or_deleted.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"9541f321-7cba-4b43-80fc-fbd1fb922808","title":"Azure Kubernetes Cluster Created or Deleted","status":"test","level":"low","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/9541f321-7cba-4b43-80fc-fbd1fb922808.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_kubernetes_cluster_created_or_deleted.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"08d6ac24-c927-4469-b3b7-2e422d6e3c43","title":"Azure Kubernetes Network Policy Change","status":"test","level":"medium","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/08d6ac24-c927-4469-b3b7-2e422d6e3c43.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_kubernetes_network_policy_change.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"818fee0c-e0ec-4e45-824e-83e4817b0887","title":"Azure Kubernetes Sensitive Role Access","status":"test","level":"medium","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/818fee0c-e0ec-4e45-824e-83e4817b0887.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_kubernetes_role_access.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"25cb259b-bbdc-4b87-98b7-90d7c72f8743","title":"Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted","status":"test","level":"medium","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/25cb259b-bbdc-4b87-98b7-90d7c72f8743.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_kubernetes_rolebinding_modified_or_deleted.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"7ee0b4aa-d8d4-4088-b661-20efdf41a04c","title":"Azure Kubernetes Secret or Config Object Access","status":"test","level":"medium","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/7ee0b4aa-d8d4-4088-b661-20efdf41a04c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_kubernetes_secret_or_config_object_access.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"12d027c3-b48c-4d9d-8bb6-a732200034b2","title":"Azure Kubernetes Service Account Modified or Deleted","status":"test","level":"medium","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/12d027c3-b48c-4d9d-8bb6-a732200034b2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_kubernetes_service_account_modified_or_deleted.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"ea61bb82-a5e0-42e6-8537-91d29500f1b9","title":"Potential Abuse of Linux Magic System Request Key","status":"experimental","level":"medium","logsource":{"product":"linux","service":"auditd","definition":"Required auditd configuration:\n-w /proc/sysrq-trigger -p wa -k sysrq\n-w /proc/sys/kernel/sysrq -p wa -k sysrq\n"},"data_path":"data/detection-rules/ea61bb82-a5e0-42e6-8537-91d29500f1b9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/path/lnx_auditd_magic_system_request_key.yml","author":"Milad Cheraghi","kind":"sigma"},{"id":"de25eeb8-3655-4643-ac3a-b662d3f26b6b","title":"Disable Or Stop Services","status":"test","level":"medium","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/de25eeb8-3655-4643-ac3a-b662d3f26b6b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_services_stop_and_disable.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"570ae5ec-33dc-427c-b815-db86228ad43e","title":"Application Uninstalled","status":"test","level":"low","logsource":{"product":"windows","service":"application"},"data_path":"data/detection-rules/570ae5ec-33dc-427c-b815-db86228ad43e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/application/msiinstaller/win_builtin_remove_application.yml","author":"frack113","kind":"sigma"},{"id":"9e3cb244-bdb8-4632-8c90-6079c8f4f16d","title":"Important Scheduled Task Deleted or Disabled","status":"test","level":"high","logsource":{"product":"windows","service":"taskscheduler","definition":"Requirements: The \"Microsoft-Windows-TaskScheduler/Operational\" is disabled by default and needs to be enabled in order for this detection to trigger"},"data_path":"data/detection-rules/9e3cb244-bdb8-4632-8c90-6079c8f4f16d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete_or_disable.yml","author":"frack113","kind":"sigma"},{"id":"88872991-7445-4a22-90b2-a3adadb0e827","title":"Stop Windows Service Via Net.EXE","status":"test","level":"low","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/88872991-7445-4a22-90b2-a3adadb0e827.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_net_stop_service.yml","author":"Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"c49c5062-0966-4170-9efd-9968c913a6cf","title":"Stop Windows Service Via PowerShell Stop-Service","status":"test","level":"low","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/c49c5062-0966-4170-9efd-9968c913a6cf.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_stop_service.yml","author":"Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"81bcb81b-5b1f-474b-b373-52c871aaa7b1","title":"Stop Windows Service Via Sc.EXE","status":"test","level":"low","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/81bcb81b-5b1f-474b-b373-52c871aaa7b1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sc_stop_service.yml","author":"Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"dbc1f800-0fe0-4bc0-9c66-292c2abe3f78","title":"Delete Important Scheduled Task","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/dbc1f800-0fe0-4bc0-9c66-292c2abe3f78.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_schtasks_delete.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"220457c1-1c9f-4c2e-afe6-9598926222c1","title":"Delete All Scheduled Tasks","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/220457c1-1c9f-4c2e-afe6-9598926222c1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_schtasks_delete_all.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"9ac94dc8-9042-493c-ba45-3b5e7c86b980","title":"Disable Important Scheduled Task","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/9ac94dc8-9042-493c-ba45-3b5e7c86b980.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_schtasks_disable.yml","author":"frack113, Nasreddine Bencherchali (Nextron Systems), X__Junior","kind":"sigma"},{"id":"ce72ef99-22f1-43d4-8695-419dcb5d9330","title":"Suspicious Windows Service Tampering","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/ce72ef99-22f1-43d4-8695-419dcb5d9330.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_service_tamper.yml","author":"Nasreddine Bencherchali (Nextron Systems), frack113 , X__Junior (Nextron Systems)","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0021","name":"Behavioral Detection for Service Stop across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0021","stix_id":"x-mitre-detection-strategy--ae37afa8-87d5-4091-ac33-010e78eefe97","relationship_id":"relationship--091187a1-a960-4731-829d-de865e7d49a1","description":"","analytics":[{"id":"AN0061","name":"Analytic 0061","guidance":"Adversary disables or stops critical services (e.g., Exchange, SQL, AV, endpoint monitoring) using native utilities or API calls, often preceding destructive actions (T1485, T1486). Behavioral chain: Elevated execution context + stop-service or sc.exe or ChangeServiceConfigW + terminated or disabled service + possible follow-up file manipulation.","url":"https://attack.mitre.org/detectionstrategies/DET0021#AN0061","platforms":["Windows"],"tuning":[{"field":"TimeWindow","description":"Time span between elevated privilege use and critical service stop"},{"field":"ServiceName","description":"Service names of interest (e.g., MSExchangeIS, SQLSERVERAGENT)"},{"field":"ParentProcess","description":"Upstream process lineage leading to service stop"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0061","source_url":"https://attack.mitre.org/detectionstrategies/DET0021#AN0061","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0088","component":"Logon Session Metadata","name":"WinEventLog:Security","channel":"EventCode=4672","platforms":["Windows"],"analytic_id":"AN0061","source_url":"https://attack.mitre.org/detectionstrategies/DET0021#AN0061","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0088/"},{"component_id":"DC0060","component":"Service Creation","name":"WinEventLog:System","channel":"EventCode=7036","platforms":["Windows"],"analytic_id":"AN0061","source_url":"https://attack.mitre.org/detectionstrategies/DET0021#AN0061","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0060/"},{"component_id":"DC0041","component":"Service Metadata","name":"WinEventLog:Sysmon","channel":"EventCode=4","platforms":["Windows"],"analytic_id":"AN0061","source_url":"https://attack.mitre.org/detectionstrategies/DET0021#AN0061","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0041/"}]},{"id":"AN0062","name":"Analytic 0062","guidance":"Adversary executes systemctl or service stop targeting high-value services (e.g., mysql, sshd), possibly followed by rm or shred against data stores. Behavioral chain: sudo/su usage + stop command + /var/log/messages or syslog entries + file access/delete.","url":"https://attack.mitre.org/detectionstrategies/DET0021#AN0062","platforms":["Linux"],"tuning":[{"field":"TimeWindow","description":"Window between service stop and suspicious file deletion"},{"field":"ExecUser","description":"Username or UID executing service stop command"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve of systemctl or service stop","platforms":["Linux"],"analytic_id":"AN0062","source_url":"https://attack.mitre.org/detectionstrategies/DET0021#AN0062","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0040","component":"File Deletion","name":"auditd:SYSCALL","channel":"unlink/unlinkat on service binaries or data targets","platforms":["Linux"],"analytic_id":"AN0062","source_url":"https://attack.mitre.org/detectionstrategies/DET0021#AN0062","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0040/"},{"component_id":"DC0041","component":"Service Metadata","name":"linux:syslog","channel":"service stopped messages","platforms":["Linux"],"analytic_id":"AN0062","source_url":"https://attack.mitre.org/detectionstrategies/DET0021#AN0062","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0041/"}]},{"id":"AN0063","name":"Analytic 0063","guidance":"Use of launchctl to stop services or kill critical background processes (e.g., securityd, com.apple.*), typically followed by command-line tools like rm or diskutil. Behavioral chain: Terminal or remote shell + launchctl bootout/disable + process termination + follow-on modification.","url":"https://attack.mitre.org/detectionstrategies/DET0021#AN0063","platforms":["macOS"],"tuning":[{"field":"ServiceLabel","description":"Launch daemon label or name targeted by command"},{"field":"LaunchType","description":"Whether the command disables or boots out the service"}],"log_sources":[{"component_id":"DC0041","component":"Service Metadata","name":"macos:unifiedlog","channel":"launchctl disable or bootout calls","platforms":["macOS"],"analytic_id":"AN0063","source_url":"https://attack.mitre.org/detectionstrategies/DET0021#AN0063","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0041/"},{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve of launchctl or pkill","platforms":["macOS"],"analytic_id":"AN0063","source_url":"https://attack.mitre.org/detectionstrategies/DET0021#AN0063","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0064","name":"Analytic 0064","guidance":"Attacker disables VM-related services or stops VMs forcibly to target vmdk or logs. Behavioral chain: esxcli or vim-cmd stop + audit log showing user privilege use + datastore file manipulation.","url":"https://attack.mitre.org/detectionstrategies/DET0021#AN0064","platforms":["ESXi"],"tuning":[{"field":"VMName","description":"Targeted virtual machine name"},{"field":"InitiatorUser","description":"User who issued stop or disable command"}],"log_sources":[{"component_id":"DC0041","component":"Service Metadata","name":"esxi:hostd","channel":"Stop VM or disable service events via vim-cmd","platforms":["ESXi"],"analytic_id":"AN0064","source_url":"https://attack.mitre.org/detectionstrategies/DET0021#AN0064","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0041/"},{"component_id":"DC0033","component":"Process Termination","name":"esxi:hostd","channel":"Log entries indicating VM powered off or forcibly terminated","platforms":["ESXi"],"analytic_id":"AN0064","source_url":"https://attack.mitre.org/detectionstrategies/DET0021#AN0064","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0033/"}]}]}],"telemetry_references":[{"id":"DC0040","name":"File Deletion","tag":"File Deletion","page":"telemetry/DC0040/","kind":"attack_component"},{"id":"DC0088","name":"Logon Session Metadata","tag":"Logon Session Metadata","page":"telemetry/DC0088/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0033","name":"Process Termination","tag":"Process Termination","page":"telemetry/DC0033/","kind":"attack_component"},{"id":"DC0060","name":"Service Creation","tag":"Service Creation","page":"telemetry/DC0060/","kind":"attack_component"},{"id":"DC0041","name":"Service Metadata","tag":"Service Metadata","page":"telemetry/DC0041/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0365","name":"Olympic Destroyer","url":"https://attack.mitre.org/software/S0365","kind":"malware","description":"[Olympic Destroyer](https://attack.mitre.org/software/S0365) uses the API call <code>ChangeServiceConfigW</code> to disable all services on the affected system.(Citation: Talos Olympic Destroyer 2018)","relationship_id":"relationship--24af852e-f761-4c75-8aa0-edc3198bd7eb","references":[{"source_name":"Talos Olympic Destroyer 2018","description":"Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.","url":"https://blog.talosintelligence.com/2018/02/olympic-destroyer.html"}]},{"id":"S0366","name":"WannaCry","url":"https://attack.mitre.org/software/S0366","kind":"malware","description":"[WannaCry](https://attack.mitre.org/software/S0366) attempts to kill processes associated with Exchange, Microsoft SQL Server, and MySQL to make it possible to encrypt their data stores.(Citation: FireEye WannaCry 2017)(Citation: SecureWorks WannaCry Analysis)","relationship_id":"relationship--1427027f-0fd1-4781-b4b3-06dc8e6e9998","references":[{"source_name":"FireEye WannaCry 2017","description":"Berry, A., Homan, J., and Eitzman, R. (2017, May 23). WannaCry Malware Profile. Retrieved March 15, 2019.","url":"https://www.fireeye.com/blog/threat-research/2017/05/wannacry-malware-profile.html"},{"source_name":"SecureWorks WannaCry Analysis","description":"Counter Threat Unit Research Team. (2017, May 18). WCry Ransomware Analysis. Retrieved March 26, 2019.","url":"https://www.secureworks.com/research/wcry-ransomware-analysis"}]},{"id":"S0400","name":"RobbinHood","url":"https://attack.mitre.org/software/S0400","kind":"malware","description":"[RobbinHood](https://attack.mitre.org/software/S0400) stops 181 Windows services on the system before beginning the encryption process.(Citation: CarbonBlack RobbinHood May 2019) ","relationship_id":"relationship--3e4f8216-03ef-4e7a-8a4a-28905fb0f474","references":[{"source_name":"CarbonBlack RobbinHood May 2019","description":"Lee, S. (2019, May 17). CB TAU Threat Intelligence Notification: RobbinHood Ransomware Stops 181 Windows Services Before Encryption. Retrieved July 29, 2019.","url":"https://www.carbonblack.com/2019/05/17/cb-tau-threat-intelligence-notification-robbinhood-ransomware-stops-181-windows-services-before-encryption/"}]},{"id":"S0431","name":"HotCroissant","url":"https://attack.mitre.org/software/S0431","kind":"malware","description":"[HotCroissant](https://attack.mitre.org/software/S0431) has the ability to stop services on the infected host.(Citation: Carbon Black HotCroissant April 2020)","relationship_id":"relationship--92e19c14-504e-402f-b755-08358333cda0","references":[{"source_name":"Carbon Black HotCroissant April 2020","description":"Knight, S.. (2020, April 16). VMware Carbon Black TAU Threat Analysis: The Evolution of Lazarus. Retrieved May 1, 2020.","url":"https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/"}]},{"id":"S0446","name":"Ryuk","url":"https://attack.mitre.org/software/S0446","kind":"malware","description":"[Ryuk](https://attack.mitre.org/software/S0446) has called <code>kill.bat</code> for stopping services, disabling services and killing processes.(Citation: CrowdStrike Ryuk January 2019)","relationship_id":"relationship--60135ffa-b3f7-4aa8-b12e-faa2719dc5d7","references":[{"source_name":"CrowdStrike Ryuk January 2019","description":"Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020.","url":"https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/"}]},{"id":"S0449","name":"Maze","url":"https://attack.mitre.org/software/S0449","kind":"malware","description":"[Maze](https://attack.mitre.org/software/S0449) has stopped SQL services to ensure it can encrypt any database.(Citation: Sophos Maze VM September 2020) ","relationship_id":"relationship--dcd5b361-b86b-47c7-8ce8-85918e00a224","references":[{"source_name":"Sophos Maze VM September 2020","description":"Brandt, A., Mackenzie, P.. (2020, September 17). Maze Attackers Adopt Ragnar Locker Virtual Machine Technique. Retrieved October 9, 2020.","url":"https://news.sophos.com/en-us/2020/09/17/maze-attackers-adopt-ragnar-locker-virtual-machine-technique/"}]},{"id":"S0457","name":"Netwalker","url":"https://attack.mitre.org/software/S0457","kind":"malware","description":"[Netwalker](https://attack.mitre.org/software/S0457) can terminate system processes and services, some of which relate to backup software.(Citation: TrendMicro Netwalker May 2020)","relationship_id":"relationship--e6a3f7bf-33c3-4d4c-bb27-46bd2842c750","references":[{"source_name":"TrendMicro Netwalker May 2020","description":"Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/netwalker-fileless-ransomware-injected-via-reflective-loading/"}]},{"id":"S0481","name":"Ragnar Locker","url":"https://attack.mitre.org/software/S0481","kind":"malware","description":"[Ragnar Locker](https://attack.mitre.org/software/S0481) has attempted to stop services associated with business applications and databases to release the lock on files used by these applications so they may be encrypted.(Citation: Sophos Ragnar May 2020)","relationship_id":"relationship--9212f940-021e-49b1-b500-fa1dd76b7132","references":[{"source_name":"Sophos Ragnar May 2020","description":"SophosLabs. (2020, May 21). Ragnar Locker ransomware deploys virtual machine to dodge security. Retrieved June 29, 2020.","url":"https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/"}]},{"id":"S0496","name":"REvil","url":"https://attack.mitre.org/software/S0496","kind":"malware","description":"[REvil](https://attack.mitre.org/software/S0496) has the capability to stop services and kill processes.(Citation: Intel 471 REvil March 2020)(Citation: Secureworks REvil September 2019)","relationship_id":"relationship--50900340-6edc-447c-aa1c-f73f5d72e4c6","references":[{"source_name":"Intel 471 REvil March 2020","description":"Intel 471 Malware Intelligence team. (2020, March 31). REvil Ransomware-as-a-Service – An analysis of a ransomware affiliate operation. Retrieved August 4, 2020.","url":"https://intel471.com/blog/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/"},{"source_name":"Secureworks REvil September 2019","description":"Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.","url":"https://www.secureworks.com/research/revil-sodinokibi-ransomware"}]},{"id":"S0533","name":"SLOTHFULMEDIA","url":"https://attack.mitre.org/software/S0533","kind":"malware","description":"[SLOTHFULMEDIA](https://attack.mitre.org/software/S0533) has the capability to stop processes and services.(Citation: CISA MAR SLOTHFULMEDIA October 2020)","relationship_id":"relationship--922cc16d-2242-477b-89db-1ba3d5176e12","references":[{"source_name":"CISA MAR SLOTHFULMEDIA October 2020","description":"DHS/CISA, Cyber National Mission Force. (2020, October 1). Malware Analysis Report (MAR) MAR-10303705-1.v1 – Remote Access Trojan: SLOTHFULMEDIA. Retrieved October 2, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"}]},{"id":"S0556","name":"Pay2Key","url":"https://attack.mitre.org/software/S0556","kind":"malware","description":"[Pay2Key](https://attack.mitre.org/software/S0556) can stop the MS SQL service at the end of the encryption process to release files locked by the service.(Citation: Check Point Pay2Key November 2020)","relationship_id":"relationship--287368b4-d3ed-489d-9fe2-288168763ac4","references":[{"source_name":"Check Point Pay2Key November 2020","description":"Check Point. (2020, November 6). Ransomware Alert: Pay2Key. Retrieved January 4, 2021.","url":"https://research.checkpoint.com/2020/ransomware-alert-pay2key/"}]},{"id":"S0575","name":"Conti","url":"https://attack.mitre.org/software/S0575","kind":"malware","description":"[Conti](https://attack.mitre.org/software/S0575) can stop up to 146 Windows services related to security, backup, database, and email solutions through the use of <code>net stop</code>.(Citation: CarbonBlack Conti July 2020)","relationship_id":"relationship--59cb7691-e0a0-4e34-94ae-63d3e22f21c1","references":[{"source_name":"CarbonBlack Conti July 2020","description":"Baskin, B. (2020, July 8). TAU Threat Discovery: Conti Ransomware. Retrieved February 17, 2021.","url":"https://www.carbonblack.com/blog/tau-threat-discovery-conti-ransomware/"}]},{"id":"S0576","name":"MegaCortex","url":"https://attack.mitre.org/software/S0576","kind":"malware","description":"[MegaCortex](https://attack.mitre.org/software/S0576) can stop and disable services on the system.(Citation: IBM MegaCortex) ","relationship_id":"relationship--7f58088d-9b5d-46ba-b9e4-fc937ffae294","references":[{"source_name":"IBM MegaCortex","description":"Del Fierro, C. Kessem, L.. (2020, January 8). From Mega to Giga: Cross-Version Comparison of Top MegaCortex Modifications. Retrieved February 15, 2021.","url":"https://securityintelligence.com/posts/from-mega-to-giga-cross-version-comparison-of-top-megacortex-modifications/"}]},{"id":"S0582","name":"LookBack","url":"https://attack.mitre.org/software/S0582","kind":"malware","description":"[LookBack](https://attack.mitre.org/software/S0582) can kill processes and delete services.(Citation: Proofpoint LookBack Malware Aug 2019)","relationship_id":"relationship--08bc171a-147c-4888-a0cb-c5fcebdc9b95","references":[{"source_name":"Proofpoint LookBack Malware Aug 2019","description":"Raggi, M. Schwarz, D.. (2019, August 1). LookBack Malware Targets the United States Utilities Sector with Phishing Attacks Impersonating Engineering Licensing Boards. Retrieved February 25, 2021.","url":"https://www.proofpoint.com/us/threat-insight/post/lookback-malware-targets-united-states-utilities-sector-phishing-attacks"}]},{"id":"S0583","name":"Pysa","url":"https://attack.mitre.org/software/S0583","kind":"malware","description":"[Pysa](https://attack.mitre.org/software/S0583) can stop services and processes.(Citation: CERT-FR PYSA April 2020) ","relationship_id":"relationship--cdbbaa5b-c1d7-4e94-8a0e-a0be60ec377c","references":[{"source_name":"CERT-FR PYSA April 2020","description":"CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-003.pdf"}]},{"id":"S0604","name":"Industroyer","url":"https://attack.mitre.org/software/S0604","kind":"malware","description":"[Industroyer](https://attack.mitre.org/software/S0604)’s data wiper module writes zeros into the registry keys in <code>SYSTEM\\CurrentControlSet\\Services</code> to render a system inoperable.(Citation: Dragos Crashoverride 2017)","relationship_id":"relationship--88484d85-3c8e-4ccc-b82b-650c6c9bc825","references":[{"source_name":"Dragos Crashoverride 2017","description":"Dragos Inc.. (2017, June 13). CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations. Retrieved December 18, 2020.","url":"https://dragos.com/blog/crashoverride/CrashOverride-01.pdf"}]},{"id":"S0605","name":"EKANS","url":"https://attack.mitre.org/software/S0605","kind":"malware","description":"[EKANS](https://attack.mitre.org/software/S0605) stops database, data backup solution, antivirus, and ICS-related processes.(Citation: Dragos EKANS)(Citation: FireEye Ransomware Feb 2020)(Citation: Palo Alto Unit 42 EKANS)","relationship_id":"relationship--a3a89546-f4fe-47f6-9109-89f6fa5af151","references":[{"source_name":"Dragos EKANS","description":"Dragos. (2020, February 3). EKANS Ransomware and ICS Operations. Retrieved February 9, 2021.","url":"https://www.dragos.com/blog/industry-news/ekans-ransomware-and-ics-operations/"},{"source_name":"FireEye Ransomware Feb 2020","description":"Zafra, D., et al. (2020, February 24). Ransomware Against the Machine: How Adversaries are Learning to Disrupt Industrial Production by Targeting IT and OT. Retrieved March 2, 2021.","url":"https://www.fireeye.com/blog/threat-research/2020/02/ransomware-against-machine-learning-to-disrupt-industrial-production.html"},{"source_name":"Palo Alto Unit 42 EKANS","description":"Hinchliffe, A. Santos, D. (2020, June 26). Threat Assessment: EKANS Ransomware. Retrieved February 9, 2021.","url":"https://unit42.paloaltonetworks.com/threat-assessment-ekans-ransomware/"}]},{"id":"S0607","name":"KillDisk","url":"https://attack.mitre.org/software/S0607","kind":"malware","description":"[KillDisk](https://attack.mitre.org/software/S0607) terminates various processes to get the user to reboot the victim machine.(Citation: Trend Micro KillDisk 2)","relationship_id":"relationship--8efafb84-44c7-405d-96b6-55d12f397d01","references":[{"source_name":"Trend Micro KillDisk 2","description":"Gilbert Sison, Rheniel Ramos, Jay Yaneza, Alfredo Oliveira. (2018, January 15). KillDisk Variant Hits Latin American Financial Groups. Retrieved January 12, 2021.","url":"https://www.trendmicro.com/en_us/research/18/a/new-killdisk-variant-hits-financial-organizations-in-latin-america.html"}]},{"id":"S0611","name":"Clop","url":"https://attack.mitre.org/software/S0611","kind":"malware","description":"[Clop](https://attack.mitre.org/software/S0611) can kill several processes and services related to backups and security solutions.(Citation: Unit42 Clop April 2021)(Citation: Mcafee Clop Aug 2019) ","relationship_id":"relationship--056d19a6-8f3c-48a6-a459-69394e39fb9a","references":[{"source_name":"Unit42 Clop April 2021","description":"Santos, D. (2021, April 13). Threat Assessment: Clop Ransomware. Retrieved July 30, 2021.","url":"https://unit42.paloaltonetworks.com/clop-ransomware/"},{"source_name":"Mcafee Clop Aug 2019","description":"Mundo, A. (2019, August 1). Clop Ransomware. Retrieved May 10, 2021.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/clop-ransomware/"}]},{"id":"S0625","name":"Cuba","url":"https://attack.mitre.org/software/S0625","kind":"malware","description":"[Cuba](https://attack.mitre.org/software/S0625) has a hardcoded list of services and processes to terminate.(Citation: McAfee Cuba April 2021)","relationship_id":"relationship--677ec8f6-e06d-4d84-82de-af20953450ec","references":[{"source_name":"McAfee Cuba April 2021","description":"Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-cuba-ransomware.pdf"}]},{"id":"S0638","name":"Babuk","url":"https://attack.mitre.org/software/S0638","kind":"malware","description":"[Babuk](https://attack.mitre.org/software/S0638) can stop specific services related to backups.(Citation: Sogeti CERT ESEC Babuk March 2021)(Citation: McAfee Babuk February 2021)(Citation: Trend Micro Ransomware February 2021)","relationship_id":"relationship--4f5efe16-ce46-4e37-9c9d-d45b14d1ab4c","references":[{"source_name":"Sogeti CERT ESEC Babuk March 2021","description":"Sogeti. (2021, March). Babuk Ransomware. Retrieved August 11, 2021.","url":"https://www.sogeti.com/globalassets/reports/cybersecchronicles_-_babuk.pdf"},{"source_name":"McAfee Babuk February 2021","description":"Mundo, A. et al. (2021, February). Technical Analysis of Babuk Ransomware. Retrieved August 11, 2021.","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-babuk-ransomware.pdf"},{"source_name":"Trend Micro Ransomware February 2021","description":"Centero, R. et al. (2021, February 5). New in Ransomware: Seth-Locker, Babuk Locker, Maoloa, TeslaCrypt, and CobraLocker. Retrieved August 11, 2021.","url":"https://www.trendmicro.com/en_us/research/21/b/new-in-ransomware.html"}]},{"id":"S0640","name":"Avaddon","url":"https://attack.mitre.org/software/S0640","kind":"malware","description":"[Avaddon](https://attack.mitre.org/software/S0640) looks for and attempts to stop database processes.(Citation: Arxiv Avaddon Feb 2021)","relationship_id":"relationship--238f92b3-2573-4332-b290-4685301eae6d","references":[{"source_name":"Arxiv Avaddon Feb 2021","description":"Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.","url":"https://arxiv.org/pdf/2102.04796.pdf"}]},{"id":"S0659","name":"Diavol","url":"https://attack.mitre.org/software/S0659","kind":"malware","description":"[Diavol](https://attack.mitre.org/software/S0659) will terminate services using the Service Control Manager (SCM) API.(Citation: Fortinet Diavol July 2021) ","relationship_id":"relationship--2035eee7-c1c3-4039-9fc0-af85b21a5e3f","references":[{"source_name":"Fortinet Diavol July 2021","description":"Neeamni, D., Rubinfeld, A.. (2021, July 1). Diavol - A New Ransomware Used By Wizard Spider?. Retrieved November 12, 2021.","url":"https://www.fortinet.com/blog/threat-research/diavol-new-ransomware-used-by-wizard-spider"}]},{"id":"S0688","name":"Meteor","url":"https://attack.mitre.org/software/S0688","kind":"malware","description":"[Meteor](https://attack.mitre.org/software/S0688) can disconnect all network adapters on a compromised host using `powershell -Command \"Get-WmiObject -class Win32_NetworkAdapter | ForEach { If ($.NetEnabled) { $.Disable() } }\" > NUL`.(Citation: Check Point Meteor Aug 2021)","relationship_id":"relationship--0f677d2e-2cff-4b9f-ae1b-621a5e856b08","references":[{"source_name":"Check Point Meteor Aug 2021","description":"Check Point Research Team. (2021, August 14). Indra - Hackers Behind Recent Attacks on Iran. Retrieved February 17, 2022.","url":"https://research.checkpoint.com/2021/indra-hackers-behind-recent-attacks-on-iran/"}]},{"id":"S0697","name":"HermeticWiper","url":"https://attack.mitre.org/software/S0697","kind":"malware","description":"[HermeticWiper](https://attack.mitre.org/software/S0697) has the ability to stop the Volume Shadow Copy service.(Citation: Qualys Hermetic Wiper March 2022)","relationship_id":"relationship--d4ac896d-31ac-4c4a-a4d5-3134e6bd8622","references":[{"source_name":"Qualys Hermetic Wiper March 2022","description":"Dani, M. (2022, March 1). Ukrainian Targets Hit by HermeticWiper, New Datawiper Malware. Retrieved March 25, 2022.","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/03/01/ukrainian-targets-hit-by-hermeticwiper-new-datawiper-malware"}]},{"id":"S1053","name":"AvosLocker","url":"https://attack.mitre.org/software/S1053","kind":"malware","description":"[AvosLocker](https://attack.mitre.org/software/S1053) has terminated specific processes before encryption.(Citation: Malwarebytes AvosLocker Jul 2021)","relationship_id":"relationship--b56db835-3b80-49e8-964d-0c1c52d182fe","references":[{"source_name":"Malwarebytes AvosLocker Jul 2021","description":"Hasherezade. (2021, July 23). AvosLocker enters the ransomware scene, asks for partners. Retrieved January 11, 2023.","url":"https://www.malwarebytes.com/blog/threat-intelligence/2021/07/avoslocker-enters-the-ransomware-scene-asks-for-partners"}]},{"id":"S1058","name":"Prestige","url":"https://attack.mitre.org/software/S1058","kind":"malware","description":"[Prestige](https://attack.mitre.org/software/S1058) has attempted to stop the MSSQL Windows service to ensure successful encryption using `C:\\Windows\\System32\\net.exe stop MSSQLSERVER`.(Citation: Microsoft Prestige ransomware October 2022)","relationship_id":"relationship--28038d61-fe2d-443c-a573-2ec1dc1123e2","references":[{"source_name":"Microsoft Prestige ransomware October 2022","description":"MSTIC. (2022, October 14). New “Prestige” ransomware impacts organizations in Ukraine and Poland. Retrieved January 19, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"}]},{"id":"S1068","name":"BlackCat","url":"https://attack.mitre.org/software/S1068","kind":"malware","description":"[BlackCat](https://attack.mitre.org/software/S1068) has the ability to stop VM services on compromised networks.(Citation: Microsoft BlackCat Jun 2022)(Citation: Sophos BlackCat Jul 2022)","relationship_id":"relationship--2ee6e8e6-914a-4639-88cc-39c01de5d541","references":[{"source_name":"Sophos BlackCat Jul 2022","description":"Brandt, Andrew. (2022, July 14). BlackCat ransomware attacks not merely a byproduct of bad luck. Retrieved December 20, 2022.","url":"https://news.sophos.com/en-us/2022/07/14/blackcat-ransomware-attacks-not-merely-a-byproduct-of-bad-luck/"},{"source_name":"Microsoft BlackCat Jun 2022","description":"Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.","url":"https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/"}]},{"id":"S1073","name":"Royal","url":"https://attack.mitre.org/software/S1073","kind":"malware","description":"[Royal](https://attack.mitre.org/software/S1073) can use `RmShutDown` to kill  applications and services using the resources that are targeted for encryption.(Citation: Cybereason Royal December 2022)","relationship_id":"relationship--1fe61df4-3a67-4c46-87f5-771a42323e53","references":[{"source_name":"Cybereason Royal December 2022","description":"Cybereason Global SOC and Cybereason Security Research Teams. (2022, December 14). Royal Rumble: Analysis of Royal Ransomware. Retrieved March 30, 2023.","url":"https://www.cybereason.com/blog/royal-ransomware-analysis"}]},{"id":"S1096","name":"Cheerscrypt","url":"https://attack.mitre.org/software/S1096","kind":"malware","description":"[Cheerscrypt](https://attack.mitre.org/software/S1096) has the ability to terminate VM processes on compromised hosts through execution of `esxcli vm process kill`.(Citation: Trend Micro Cheerscrypt May 2022)\n","relationship_id":"relationship--26cc808a-2986-4dcf-9ce6-86175cfa366c","references":[{"source_name":"Trend Micro Cheerscrypt May 2022","description":"Dela Cruz, A. et al. (2022, May 25). New Linux-Based Ransomware Cheerscrypt Targeting ESXi Devices Linked to Leaked Babuk Source Code. Retrieved December 19, 2023.","url":"https://www.trendmicro.com/en_se/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html"}]},{"id":"S1139","name":"INC Ransomware","url":"https://attack.mitre.org/software/S1139","kind":"malware","description":"[INC Ransomware](https://attack.mitre.org/software/S1139) can issue a command to kill a process on compromised hosts.(Citation: Cybereason INC Ransomware November 2023)","relationship_id":"relationship--f507e65e-735e-40af-bb77-cd9f0b14f8f1","references":[{"source_name":"Cybereason INC Ransomware November 2023","description":"Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.","url":"https://web.archive.org/web/20231202022946/https://www.cybereason.com/hubfs/dam/collateral/reports/threat-alert-inc-ransomware.pdf"}]},{"id":"S1150","name":"ROADSWEEP","url":"https://attack.mitre.org/software/S1150","kind":"malware","description":"[ROADSWEEP](https://attack.mitre.org/software/S1150) can disable critical services and processes.(Citation: Mandiant ROADSWEEP August 2022)","relationship_id":"relationship--bdc99461-1e2b-4fba-bf39-a5e17f7d3384","references":[{"source_name":"Mandiant ROADSWEEP August 2022","description":"Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}]},{"id":"S1181","name":"BlackByte 2.0 Ransomware","url":"https://attack.mitre.org/software/S1181","kind":"malware","description":"[BlackByte 2.0 Ransomware](https://attack.mitre.org/software/S1181) can terminate running services.(Citation: Microsoft BlackByte 2023)","relationship_id":"relationship--9a7835e3-5d9a-440c-84c2-5a1f60fef646","references":[{"source_name":"Microsoft BlackByte 2023","description":"Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}]},{"id":"S1191","name":"Megazord","url":"https://attack.mitre.org/software/S1191","kind":"malware","description":"[Megazord](https://attack.mitre.org/software/S1191) has the ability to terminate a list of services and processes.(Citation: Palo Alto Howling Scorpius DEC 2024)","relationship_id":"relationship--457340c8-e8d9-49e3-810b-cbd58c6d6212","references":[{"source_name":"Palo Alto Howling Scorpius DEC 2024","description":"Zemah, Y. (2024, December 2). Threat Assessment: Howling Scorpius (Akira Ransomware). Retrieved January 8, 2025.","url":"https://unit42.paloaltonetworks.com/threat-assessment-howling-scorpius-akira-ransomware/"}]},{"id":"S1194","name":"Akira _v2","url":"https://attack.mitre.org/software/S1194","kind":"malware","description":"[Akira _v2](https://attack.mitre.org/software/S1194) can stop running virtual machines.(Citation: CISA Akira Ransomware APR 2024)(Citation: Cisco Akira Ransomware OCT 2024)(Citation: Palo Alto Howling Scorpius DEC 2024)","relationship_id":"relationship--f67c6c6d-8e35-408a-87cf-6f9af30d73b9","references":[{"source_name":"CISA Akira Ransomware APR 2024","description":"CISA et al. (2024, April 18). #StopRansomware: Akira Ransomware. Retrieved December 10, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-04/aa24-109a-stopransomware-akira-ransomware_2.pdf"},{"source_name":"Cisco Akira Ransomware OCT 2024","description":"Nutland, J. and Szeliga, M. (2024, October 21). Akira ransomware continues to evolve. Retrieved December 10, 2024.","url":"https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve/"},{"source_name":"Palo Alto Howling Scorpius DEC 2024","description":"Zemah, Y. (2024, December 2). Threat Assessment: Howling Scorpius (Akira Ransomware). Retrieved January 8, 2025.","url":"https://unit42.paloaltonetworks.com/threat-assessment-howling-scorpius-akira-ransomware/"}]},{"id":"S1199","name":"LockBit 2.0","url":"https://attack.mitre.org/software/S1199","kind":"malware","description":"[LockBit 2.0](https://attack.mitre.org/software/S1199) can automatically terminate processes that may interfere with the encryption or file extraction processes.(Citation: SentinelOne LockBit 2.0)","relationship_id":"relationship--43e15d3b-02ef-4e6c-97f7-a62db9de2e3a","references":[{"source_name":"SentinelOne LockBit 2.0","description":"SentinelOne. (n.d.). LockBit 2.0: In-Depth Analysis, Detection, Mitigation, and Removal. Retrieved January 24, 2025.","url":"https://www.sentinelone.com/anthology/lockbit-2-0/"}]},{"id":"S1202","name":"LockBit 3.0","url":"https://attack.mitre.org/software/S1202","kind":"malware","description":"[LockBit 3.0](https://attack.mitre.org/software/S1202) can terminate targeted processes and services related to security, backup, database management, and other applications that could stop or interfere with encryption.(Citation: Joint Cybersecurity Advisory LockBit JUN 2023)(Citation: Sentinel Labs LockBit 3.0 JUL 2022)(Citation: Joint Cybersecurity Advisory LockBit 3.0 MAR 2023)(Citation: INCIBE-CERT LockBit MAR 2024)","relationship_id":"relationship--b90beadd-a65d-4013-a552-8d114c6c7c28","references":[{"source_name":"Joint Cybersecurity Advisory LockBit JUN 2023","description":"CISA et al. (2023, June 14). UNDERSTANDING RANSOMWARE THREAT ACTORS: LOCKBIT. Retrieved February 5, 2025.","url":"https://www.cisa.gov/sites/default/files/2023-06/aa23-165a_understanding_TA_LockBit_0.pdf"},{"source_name":"Joint Cybersecurity Advisory LockBit 3.0 MAR 2023","description":"FBI et al. (2023, March 16). #StopRansomware: LockBit 3.0. Retrieved February 5, 2025.","url":"https://www.cisa.gov/sites/default/files/2023-03/aa23-075a-stop-ransomware-lockbit.pdf"},{"source_name":"INCIBE-CERT LockBit MAR 2024","description":"INCIBE-CERT. (2024, March 14). LockBit: response and recovery actions. Retrieved February 5, 2025.","url":"https://www.incibe.es/en/incibe-cert/blog/lockbit-response-and-recovery-actions"},{"source_name":"Sentinel Labs LockBit 3.0 JUL 2022","description":"Walter, J. (2022, July 21). LockBit 3.0 Update | Unpicking the Ransomware’s Latest Anti-Analysis and Evasion Techniques. Retrieved February 5, 2025.","url":"https://www.sentinelone.com/labs/lockbit-3-0-update-unpicking-the-ransomwares-latest-anti-analysis-and-evasion-techniques"}]},{"id":"S1211","name":"Hannotog","url":"https://attack.mitre.org/software/S1211","kind":"malware","description":"[Hannotog](https://attack.mitre.org/software/S1211) can stop Windows services.(Citation: Symantec Bilbug 2022)","relationship_id":"relationship--10b78316-c0c9-43cf-9f8c-fefd022706e4","references":[{"source_name":"Symantec Bilbug 2022","description":"Symntec Threat Hunter Team. (2022, November 12). Billbug: State-sponsored Actor Targets Cert Authority, Government Agencies in Multiple Asian Countries. Retrieved March 15, 2025.","url":"https://www.security.com/threat-intelligence/espionage-asia-governments-cert-authority"}]},{"id":"S1212","name":"RansomHub","url":"https://attack.mitre.org/software/S1212","kind":"malware","description":"[RansomHub](https://attack.mitre.org/software/S1212) has the ability to terminate specified services.(Citation: Group-IB RansomHub FEB 2025)","relationship_id":"relationship--f52c6c88-f28f-41fe-ab01-7c0a06c425ac","references":[{"source_name":"Group-IB RansomHub FEB 2025","description":"Alfano, V. et al. (2025, February 12). RansomHub Never Sleeps Episode 1: The evolution of modern ransomware. Retrieved March 17, 2025.","url":"https://www.group-ib.com/blog/ransomhub-never-sleeps-episode-1/"}]},{"id":"S1217","name":"VIRTUALPITA","url":"https://attack.mitre.org/software/S1217","kind":"malware","description":"[VIRTUALPITA](https://attack.mitre.org/software/S1217) can start and stop the `vmsyslogd` service.(Citation: Google Cloud Threat Intelligence ESXi VIBs 2022)","relationship_id":"relationship--7f7f5b45-01e1-4ded-9a3d-41f701509f18","references":[{"source_name":"Google Cloud Threat Intelligence ESXi VIBs 2022","description":"Alexander Marvi, Jeremy Koppen, Tufail Ahmed, and Jonathan Lepore. (2022, September 29). Bad VIB(E)s Part One: Investigating Novel Malware Persistence Within ESXi Hypervisors. Retrieved March 26, 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/esxi-hypervisors-malware-persistence"}]},{"id":"S1242","name":"Qilin","url":"https://attack.mitre.org/software/S1242","kind":"malware","description":"[Qilin](https://attack.mitre.org/software/S1242) can terminate specific services on compromised hosts.(Citation: Trend Micro Agenda Ransomware AUG 2022)(Citation: Halcyon Qilin.B OCT 2024)(Citation: HC3 Qilin Threat Profile JUN 2024)(Citation: Cisco Talos Qilin Ransomware OCT 2025)","relationship_id":"relationship--3071d81a-db65-4324-b280-b53dccca56b6","references":[{"source_name":"Halcyon Qilin.B OCT 2024","description":"Halcyon RISE Team. (2024, October 24). New Qilin.B Ransomware Variant Boasts Enhanced Encryption and Defense Evasion. Retrieved September 26, 2025.","url":"https://www.halcyon.ai/blog/new-qilin-b-ransomware-variant-boasts-enhanced-encryption-and-defense-evasion"},{"source_name":"HC3 Qilin Threat Profile JUN 2024","description":"Health Sector Cybersecurity Coordination Center. (2024, June 18). Qilin, aka Agenda Ransomware. Retrieved September 26, 2025.","url":"https://www.aha.org/system/files/media/file/2024/06/tlp-clear-hc3-threat-profile-qilin-aka-agenda-ransomware-6-18-2024.pdf"},{"source_name":"Trend Micro Agenda Ransomware AUG 2022","description":"Magdy, S. et al. (2022, August 25). New Golang Ransomware Agenda Customizes Attacks. Retrieved September 26, 2025.","url":"https://www.trendmicro.com/en_us/research/22/h/new-golang-ransomware-agenda-customizes-attacks.html"},{"source_name":"Cisco Talos Qilin Ransomware OCT 2025","description":"Takeda, T. et al. (2025, October 26). Uncovering Qilin attack methods exposed through multiple cases. Retrieved March 26, 2026.","url":"https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/"}]},{"id":"S1244","name":"Medusa Ransomware","url":"https://attack.mitre.org/software/S1244","kind":"malware","description":"[Medusa Ransomware](https://attack.mitre.org/software/S1244) has the capability to terminate services related to backups, security, databases, communication, filesharing and websites.(Citation: CISA Medusa Group Medusa Ransomware March 2025)(Citation: Broadcom Medusa Ransomware Medusa Group March 2025)(Citation: Security Scorecard Medusa Ransomware January 2024) [Medusa Ransomware](https://attack.mitre.org/software/S1244) has also utilized the `taskkill /F /IM <process> /T` command to stop targeted processes and `net stop <process>` command to stop designated services.(Citation: Broadcom Medusa Ransomware Medusa Group March 2025)(Citation: Security Scorecard Medusa Ransomware January 2024)","relationship_id":"relationship--71f8c65a-e4fb-4aa0-88b9-353ee56da56c","references":[{"source_name":"CISA Medusa Group Medusa Ransomware March 2025","description":"Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source_name":"Broadcom Medusa Ransomware Medusa Group March 2025","description":"Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"},{"source_name":"Security Scorecard Medusa Ransomware January 2024","description":"Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}]},{"id":"S1245","name":"InvisibleFerret","url":"https://attack.mitre.org/software/S1245","kind":"malware","description":"[InvisibleFerret](https://attack.mitre.org/software/S1245) has terminated Chrome and Brave browsers using the `taskkill` command on Windows and the `killall` command on other systems such as Linux and macOS.(Citation: ESET Contagious Interview BeaverTail InvisibleFerret February 2025) [InvisibleFerret](https://attack.mitre.org/software/S1245) has also utilized it’s `ssh_kill` command to terminate Chrome and Brave browser processes.(Citation: PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023)","relationship_id":"relationship--91249ccc-a2e2-4d02-af0a-6ea20817b8ef","references":[{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","description":"Matej Havranek. (2025, February 20). DeceptiveDevelopment targets freelance developers. Retrieved October 17, 2025.","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source_name":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","description":"Unit 42. (2023, November 21). Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors. Retrieved October 17, 2025.","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"}]},{"id":"S1247","name":"Embargo","url":"https://attack.mitre.org/software/S1247","kind":"malware","description":"[Embargo](https://attack.mitre.org/software/S1247) has terminated active processes and services based on a hardcoded list using the `CloseServiceHandle()` function.(Citation: Cyble Embargo Ransomware May 2024) [Embargo](https://attack.mitre.org/software/S1247) has also leveraged MS4Killer to terminate processes contained in an embedded list of security software process names that were XOR-encrypted.(Citation: ESET Embargo Ransomware October 2024)","relationship_id":"relationship--0c7d07b5-c838-4858-a404-5f9ba0733ca4","references":[{"source_name":"Cyble Embargo Ransomware May 2024","description":"Cyble. (2024, May 24). The Rust Revolution: New Embargo Ransomware Steps In. Retrieved October 19, 2025.","url":"https://cyble.com/blog/the-rust-revolution-new-embargo-ransomware-steps-in/"},{"source_name":"ESET Embargo Ransomware October 2024","description":"Jan Holman, Tomas Zvara. (2024, October 23). Embargo ransomware: Rock’n’Rust. Retrieved October 19, 2025.","url":"https://www.welivesecurity.com/en/eset-research/embargo-ransomware-rocknrust/"}]},{"id":"S9013","name":"DRYHOOK","url":"https://attack.mitre.org/software/S9013","kind":"malware","description":"[DRYHOOK](https://attack.mitre.org/software/S9013) has terminated all instances of the `cgi-server` process before activating the modified DSAuth.pm file.(Citation: Google UNC5221 Ivanti January 2025)","relationship_id":"relationship--ed0f49d3-fe2e-48fd-bc45-65f0de468a50","references":[{"source_name":"Google UNC5221 Ivanti January 2025","description":"John Wolfram, Josh Murchie, Matt Lin, Daniel Ainsworth, Robert Wallace, Dimiter Andonov, Dhanesh Kizhakkinan, Jacob Thompson. (2025, January 8). Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation. Retrieved April 14, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day"}]},{"id":"S9014","name":"PHASEJAM","url":"https://attack.mitre.org/software/S9014","kind":"malware","description":"[PHASEJAM](https://attack.mitre.org/software/S9014) has disabled the `cgi-server` process on Ivanti Connect Secure appliances.(Citation: Google UNC5221 Ivanti January 2025)","relationship_id":"relationship--1bc748d4-6776-4bb4-a5ab-0bb8ac3dfab4","references":[{"source_name":"Google UNC5221 Ivanti January 2025","description":"John Wolfram, Josh Murchie, Matt Lin, Daniel Ainsworth, Robert Wallace, Dimiter Andonov, Dhanesh Kizhakkinan, Jacob Thompson. (2025, January 8). Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation. Retrieved April 14, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day"}]},{"id":"S9015","name":"BRICKSTORM","url":"https://attack.mitre.org/software/S9015","kind":"malware","description":"[BRICKSTORM](https://attack.mitre.org/software/S9015) has terminated an existing process to ensure that its own new process can execute.(Citation: CISA BRICKSTORM UNC5221 AR25-338A February 2026)","relationship_id":"relationship--f1df2991-428f-4ed0-9173-07609e2142c8","references":[{"source_name":"CISA BRICKSTORM UNC5221 AR25-338A February 2026","description":"DHS/CISA. (2026, February 11). AR25-338A: BRICKSTORM Backdoor. Retrieved April 16, 2026.","url":"https://www.cisa.gov/news-events/analysis-reports/ar25-338a"}]},{"id":"S9050","name":"Vidar","url":"https://attack.mitre.org/software/S9050","kind":"malware","description":"[Vidar](https://attack.mitre.org/software/S9050) has used the function `TerminateProcess` to terminate processes.(Citation: Cyfirma_Vidar_June2024)\n\n[Vidar](https://attack.mitre.org/software/S9050) has forcefully terminated a process named Devil.exe using the command `C:\\Windows\\System32\\cmd.exe” /c taskkill /im Devil.exe /f`.(Citation: Logpoint_StealerMalwareFamilies_2024)","relationship_id":"relationship--4609386c-f8e8-44d8-828c-ce33cef129ba","references":[{"source_name":"Cyfirma_Vidar_June2024","description":"CYFIRMA. (2024, June 3). Vidar Stealer: An In-depth Analysis of an Information-Stealing Malware. Retrieved August 13, 2026.","url":"https://www.cyfirma.com/research/vidar-stealer-an-in-depth-analysis-of-an-information-stealing-malware/"},{"source_name":"Logpoint_StealerMalwareFamilies_2024","description":"Khadgi, N. (n.d.). A Comprehensive Overview on Stealer Malware Families. Retrieved August 25, 2026.","url":"https://web.archive.org/web/20240517205011/https://www.logpoint.com/wp-content/uploads/2024/03/logpoint-etpr-a-comprehensive-overview-on-stealer-malware-families-1.pdf"}]},{"id":"S9051","name":"The Gentlemen Ransomware","url":"https://attack.mitre.org/software/S9051","kind":"malware","description":"[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has terminated active processes on the victim device. [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has stopped Windows services using `sc config <service name> start=disabled`, `net stop <service name>` and `sc stop <service name>`.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: CheckPointResearch_TheGentlemen_April2026) [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has also disabled running processes using the `taskkill` command for specified processes.(Citation: TrendAI_TheGentlemen_Sept2025)(Citation: CheckPointResearch_TheGentlemen_April2026) ","relationship_id":"relationship--92a6471a-aee3-459e-b350-6354afcdaaf0","references":[{"source_name":"CheckPointResearch_TheGentlemen_April2026","description":"Check Point Research. (2026, April 20). DFIR Report – The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy. Retrieved September 18, 2026.","url":"https://research.checkpoint.com/2026/dfir-report-the-gentlemen/"},{"source_name":"MSTI_GentelmenRansomware_May2026","description":"Microsoft Threat Intelligence. (2026, May 28). The Gentlemen ransomware: Dissecting a self-propagating Go encryptor . Retrieved September 18, 2026.","url":"https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/"},{"source_name":"TrendAI_TheGentlemen_Sept2025","description":"Santos, J., et al. (2025, September 9). Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures Revealed . Retrieved September 18, 2026.","url":"https://www.trendaisecurity.com/en-us/resources-insights/trendai-security-blog/unmasking-the-gentlemen-ransomware"}]},{"id":"S9052","name":"MiniFast","url":"https://attack.mitre.org/software/S9052","kind":"malware","description":"[MiniFast](https://attack.mitre.org/software/S9052) has the ability to terminate a process using its PID.(Citation: CheckPoint_NimbusManticore_May2026) ","relationship_id":"relationship--39de5d21-d971-4a00-99f7-f931fce320c7","references":[{"source_name":"CheckPoint_NimbusManticore_May2026","description":"Check Point. (2026, May 22). Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict. Retrieved September 23, 2026.","url":"https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/"}]}],"actors":[{"id":"G0032","name":"Lazarus Group","url":"https://attack.mitre.org/groups/G0032","kind":"intrusion-set","description":"[Lazarus Group](https://attack.mitre.org/groups/G0032) has stopped the MSExchangeIS service to render Exchange contents inaccessible to users.(Citation: Novetta Blockbuster Destructive Malware)","relationship_id":"relationship--411aae3a-f612-41bb-b2f0-1639d2cbc290","references":[{"source_name":"Novetta Blockbuster Destructive Malware","description":"Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Destructive Malware Report. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"}]},{"id":"G0034","name":"Sandworm Team","url":"https://attack.mitre.org/groups/G0034","kind":"intrusion-set","description":"[Sandworm Team](https://attack.mitre.org/groups/G0034) attempts to stop the MSSQL Windows service to ensure successful encryption of locked files.(Citation: Microsoft Prestige ransomware October 2022) ","relationship_id":"relationship--6cad1b79-d806-4eaa-82d3-59e23ccc6939","references":[{"source_name":"Microsoft Prestige ransomware October 2022","description":"MSTIC. (2022, October 14). New “Prestige” ransomware impacts organizations in Ukraine and Poland. Retrieved January 19, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"}]},{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) has disabled actively running virtual environments using the `KillMe` function to include VMware, Microsoft Hypervisors, and VirtualBox.(Citation: Aryaka Kimsuky July 2025)","relationship_id":"relationship--28e8118a-0baf-412b-9237-2874ccb7d19a","references":[{"source_name":"Aryaka Kimsuky July 2025","description":"Varadharajan Krishnasamy, Aditya K Sood. (2025, July 29). From Reconnaissance  to Control: The Operational Blueprint of Kimsuky APT  for Cyber Espionage. Retrieved April 18, 2026.","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"id":"G0102","name":"Wizard Spider","url":"https://attack.mitre.org/groups/G0102","kind":"intrusion-set","description":"[Wizard Spider](https://attack.mitre.org/groups/G0102) has used taskkill.exe and net.exe to stop backup, catalog, cloud, and other services prior to network encryption.(Citation: DFIR Ryuk's Return October 2020)","relationship_id":"relationship--cd283aa1-23f1-4516-9198-9d565bd4a431","references":[{"source_name":"DFIR Ryuk's Return October 2020","description":"The DFIR Report. (2020, October 8). Ryuk’s Return. Retrieved October 9, 2020.","url":"https://thedfirreport.com/2020/10/08/ryuks-return/"}]},{"id":"G0119","name":"Indrik Spider","url":"https://attack.mitre.org/groups/G0119","kind":"intrusion-set","description":"[Indrik Spider](https://attack.mitre.org/groups/G0119) has used [PsExec](https://attack.mitre.org/software/S0029) to stop services prior to the execution of ransomware.(Citation: Symantec WastedLocker June 2020)","relationship_id":"relationship--e2763cbf-c068-47b5-a871-3b20a368497f","references":[{"source_name":"Symantec WastedLocker June 2020","description":"Symantec Threat Intelligence. (2020, June 25). WastedLocker: Symantec Identifies Wave of Attacks Against U.S. Organizations. Retrieved May 20, 2021.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us"}]},{"id":"G1004","name":"LAPSUS$","url":"https://attack.mitre.org/groups/G1004","kind":"intrusion-set","description":"[LAPSUS$](https://attack.mitre.org/groups/G1004) has shut down virtual machines from within a victim's on-premise VMware ESXi infrastructure.(Citation: NCC Group LAPSUS Apr 2022)","relationship_id":"relationship--6e54e834-521f-4da8-b3ae-963185496a60","references":[{"source_name":"NCC Group LAPSUS Apr 2022","description":"Brown, D., et al. (2022, April 28). LAPSUS$: Recent techniques, tactics and procedures. Retrieved December 22, 2022.","url":"https://www.nccgroup.com/research-blog/lapsus-recent-techniques-tactics-and-procedures/"}]},{"id":"G1051","name":"Medusa Group","url":"https://attack.mitre.org/groups/G1051","kind":"intrusion-set","description":"[Medusa Group](https://attack.mitre.org/groups/G1051) has terminated services related to backups, security, databases, communication, filesharing and websites.(Citation: CISA Medusa Group Medusa Ransomware March 2025)(Citation: Broadcom Medusa Ransomware Medusa Group March 2025)(Citation: Security Scorecard Medusa Ransomware January 2024)","relationship_id":"relationship--06a73a32-7ccc-4be5-ae78-7688f121c8e1","references":[{"source_name":"CISA Medusa Group Medusa Ransomware March 2025","description":"Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source_name":"Broadcom Medusa Ransomware Medusa Group March 2025","description":"Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"},{"source_name":"Security Scorecard Medusa Ransomware January 2024","description":"Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}]}],"mitigations":[{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Limit privileges of user accounts and groups so that only authorized administrators can interact with service changes and service configurations.","relationship_id":"relationship--b5023b20-4243-4686-8b51-429ae7ac73cb","references":[]},{"id":"M1022","name":"Restrict File and Directory Permissions","url":"https://attack.mitre.org/mitigations/M1022","kind":"course-of-action","description":"Ensure proper process and file permissions are in place to inhibit adversaries from disabling or interfering with critical services.","relationship_id":"relationship--e28dc4ab-86fe-480e-9f0d-d7fab54c432d","references":[]},{"id":"M1024","name":"Restrict Registry Permissions","url":"https://attack.mitre.org/mitigations/M1024","kind":"course-of-action","description":"Ensure proper registry permissions are in place to inhibit adversaries from disabling or interfering with critical services.","relationship_id":"relationship--c00535d0-6e59-4293-8034-70e5bf94a74a","references":[]},{"id":"M1030","name":"Network Segmentation","url":"https://attack.mitre.org/mitigations/M1030","kind":"course-of-action","description":"Operate intrusion detection, analysis, and response systems on a separate network from the production environment to lessen the chances that an adversary can see and interfere with critical response functions.","relationship_id":"relationship--40cd458c-5a59-4a8d-a04a-3cd3faebaf66","references":[]},{"id":"M1060","name":"Out-of-Band Communications Channel","url":"https://attack.mitre.org/mitigations/M1060","kind":"course-of-action","description":"Develop and enforce security policies that include the use of out-of-band communication channels for critical communications during a security incident.(Citation: TrustedSec OOB Communications)","relationship_id":"relationship--b774aa5d-7731-46b4-b285-dc1c67a0d01c","references":[{"source_name":"TrustedSec OOB Communications","description":"Tyler Hudak. (2022, December 29). To OOB, or Not to OOB?: Why Out-of-Band Communications are Essential for Incident Response. Retrieved August 30, 2024.","url":"https://trustedsec.com/blog/to-oob-or-not-to-oob-why-out-of-band-communications-are-essential-for-incident-response"}]}],"candidates":[{"id":"08b4718f-a8bf-4bb5-a552-294fc5178fea","name":"Linux - Stop service by killing process using pkill","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1489/T1489.yaml","description":"Stops a specified service by sending a SIGTERM signal to the linked process using pkill. This method is effective when multiple instances of the process may be running.\nUpon execution, if any instances of the process were running, they will be terminated. If no instances were running, pkill will not find any processes to kill.\nStopped service can be restarted by running the cleanup command.\nYou can list all available services with following command: \"systemctl list-units --type=service\"\n","inputs":{"process_pattern":{"description":"Pattern to match the name of the process to kill","type":"string","default":"^cron$"},"service_name":{"description":"Name of a service to restart","type":"string","default":"cron"}},"dependencies":[],"source_definition_sha256":"caacfd1170faddaaab6e59d276d1a30adb62997182343585806b11c9c8e2abea"},{"id":"0f752206-61b2-4f2f-b397-e883a503968b","name":"Windows - iisreset.exe to stop Internet services","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1489/T1489.yaml","description":"Stops Internet services upon running. Used by BlackCat ransomware to release/prevent locks on files to be encrypted.\n","inputs":{},"dependencies":[{"description":"iireset.exe will not be found if the IIS Windows feature is disabled, which it is by default."}],"source_definition_sha256":"3bcc0ac15cd5e2c5cb2cbdcf94038f8831e2caf833598545ba76624b704cf131"},{"id":"21dfb440-830d-4c86-a3e5-2a491d5a8d04","name":"Windows - Stop service using Service Controller","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1489/T1489.yaml","description":"Stops a specified service using the sc.exe command. Upon execution, if the spooler service was running infomration will be displayed saying\nit has changed to a state of STOP_PENDING. If the spooler service was not running \"The service has not been started.\" will be displayed and it can be\nstarted by running the cleanup command.\n","inputs":{"service_name":{"description":"Name of a service to stop","type":"string","default":"spooler"}},"dependencies":[],"source_definition_sha256":"d15a2d62f27731230e2aff0b693ebde650cd28088ecb954aaf7aad3d537e2dc7"},{"id":"332f4c76-7e96-41a6-8cc2-7361c49db8be","name":"Linux - Stop service by killing process using kill","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1489/T1489.yaml","description":"Stops a specified service by sending a SIGTERM signal to the linked process using the kill command. Upon execution, if the service's main process was running, it will be terminated.\nIf the service was not running, no process will be found to kill and it can be restarted by running the cleanup command.\nYou can list all available services with following command: \"systemctl list-units --type=service\"\n","inputs":{"process_name":{"description":"Name of a process to kill","type":"string","default":"cron"},"service_name":{"description":"Name of a service to restart","type":"string","default":"cron"}},"dependencies":[],"source_definition_sha256":"edc127fa65572fe59c1142e5bc4c374516ccc9a9291a0258ee6298eaa0a5c367"},{"id":"41274289-ec9c-4213-bea4-e43c4aa57954","name":"Windows - Stop service using net.exe","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1489/T1489.yaml","description":"Stops a specified service using the net.exe command. Upon execution, if the service was running \"The Print Spooler service was stopped successfully.\"\nwill be displayed. If the service was not running, \"The Print Spooler service is not started.\" will be displayed and it can be\nstarted by running the cleanup command.\n","inputs":{"service_name":{"description":"Name of a service to stop","type":"string","default":"spooler"}},"dependencies":[],"source_definition_sha256":"ed269db926f0339135019cdacfd7a544f5a3c5975769899850322c5469770697"},{"id":"42e3a5bd-1e45-427f-aa08-2a65fa29a820","name":"Linux - Stop service using systemctl","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1489/T1489.yaml","description":"Stops a specified service using the systemctl command.\nUpon execution, if the specified service was running, it will change to a state of inactive and it can be restarted by running the cleanup command.\nYou can list all available services with following command: \"systemctl list-units --type=service\"\n","inputs":{"service_name":{"description":"Name of a service to stop","type":"string","default":"cron"}},"dependencies":[],"source_definition_sha256":"e6d09c75e7861d4e98e3dcc8727cc7d27da7debf4f4710c3bd42bfbe9ce448b0"},{"id":"6e76f56f-2373-4a6c-a63f-98b7b72761f1","name":"Abuse of linux magic system request key for Send a SIGTERM to all processes","platforms":["linux"],"method":"automated","executor":"bash","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1489/T1489.yaml","description":"Adversaries with root or sufficient privileges Send a SIGTERM to all processes, except for init. By writing 'e' to /proc/sysrq-trigger, they can forced kill all processes, except for init.\n","inputs":{},"dependencies":[],"source_definition_sha256":"a5b94e7f9402ba95b43851ee761ca2c5c448474ee21ac52c3f6fd3989c7c3b13"},{"id":"e5d95be6-02ee-4ff1-aebe-cf86013b6189","name":"Linux - Stop service by killing process using killall","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1489/T1489.yaml","description":"Stops a specified service by sending a SIGTERM signal to the linked process using the killall command.\nUpon execution, if the service's main process was running, it will be terminated.\nIf the service was not running, no process will be found to kill and it can be restarted by running the cleanup command.\nYou can list all available services with following command: \"systemctl list-units --type=service\"\n","inputs":{"process_name":{"description":"Name of a process to stop","type":"string","default":"cron"},"service_name":{"description":"Name of a service to restart","type":"string","default":"cron"}},"dependencies":[],"source_definition_sha256":"f2212cc96115bcbe9575f0fa60f3e1b14308af441a081a8cb35bfd0fcec1a9e9"},{"id":"f3191b84-c38b-400b-867e-3a217a27795f","name":"Windows - Stop service by killing process","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1489/T1489.yaml","description":"Stops a specified service killng the service's process.\nThis technique was used by WannaCry. Upon execution, if the spoolsv service was running \"SUCCESS: The process \"spoolsv.exe\" with PID 2316 has been terminated.\"\nwill be displayed. If the service was not running \"ERROR: The process \"spoolsv.exe\" not found.\" will be displayed and it can be\nstarted by running the cleanup command.\n","inputs":{"process_name":{"description":"Name of a process to kill","type":"string","default":"spoolsv.exe"}},"dependencies":[],"source_definition_sha256":"52f22afe5d3dd2158d13c08731a03d107730ecf2d311870fe73cd969d6dc0db6"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1485":"/ttp-simulation/techniques/enterprise/T1485/","T1486":"/ttp-simulation/techniques/enterprise/T1486/","T1489":"/ttp-simulation/techniques/enterprise/T1489/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1489","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0040","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"delete","archived":false}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0088","collector":"illustrative-lab-collector","observation":{"session_id":"lab-session-1","account":"LAB\\analyst","host":"lab-host-1","session_type":"interactive"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0033","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","process_id":4200,"action":"terminate"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0060","collector":"illustrative-lab-collector","observation":{"service":"LabService","action":"install","executable":"C:\\Lab\\service.exe","actor":"lab-admin"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0041","collector":"illustrative-lab-collector","observation":{"service":"LabService","executable":"C:\\Lab\\service.exe","start_mode":"manual","state":"stopped"}}]}}