{"source_checked_on":"2026-10-19","schema_version":1,"key":"ics/T0881","id":"T0881","name":"Service Stop","domain":"ics","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T0881","source_file":{"file":"ics.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/ics-attack/ics-attack-20.0.json","sha256":"c9ca0ce523a1b5e512060a390415e8aefe8f6d32c5f82d7de81264960c1e1183","bytes":5266683},"source_object_sha256":"9d3de81f4642216e28e081067a04f42727f000f07a82c664cb7c15cc525bb8fd","description":"Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment. (Citation: Enterprise ATT&CK)  Services may not allow for modification of their data stores while running. Adversaries may stop services in order to conduct Data Destruction. (Citation: Enterprise ATT&CK)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T0881","external_id":"T0881"},{"source_name":"Enterprise ATT&CK","description":"Enterprise ATT&CK Enterprise ATT&CK   Service Stop Retrieved. 2019/10/29  Service Stop Retrieved. 2019/10/29 ","url":"https://attack.mitre.org/techniques/T1489/"}],"platforms":["Embedded","Windows","Linux","Network Devices"],"environments":["cloud-hosted-endpoint","ics-ot","network-infrastructure","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0041","name":"Service Metadata","page":"telemetry/DC0041/","kind":"attack_component","category":"Host state and inventory","description":"Service configuration and current state at observation time.","collection_focus":"Inventory service name, executable, startup mode, owner and status using supported OS APIs; compare successive snapshots.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["service","executable","start_mode","state"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0041","collector":"illustrative-lab-collector","observation":{"service":"LabService","executable":"C:\\Lab\\service.exe","start_mode":"manual","state":"stopped"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."}],"detection":{"key":"ics/T0881","id":"T0881","name":"Service Stop","domain":"ics","platforms":["Embedded","Windows","Linux","Network Devices"],"environments":["cloud-hosted-endpoint","ics-ot","network-infrastructure","onprem"],"source_url":"https://attack.mitre.org/techniques/T0881","technique_page":"techniques/ics/T0881/","page":"detections/ics/T0881/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0765","name":"Detection of Service Stop","url":"https://attack.mitre.org/detectionstrategies/DET0765","stix_id":"x-mitre-detection-strategy--b25c4621-5d38-43ee-871e-0e5c02f2f48c","relationship_id":"relationship--a9dd70c2-2f54-4b19-85df-df11cbeb0dbd","description":"","analytics":[{"id":"AN1897","name":"Analytic 1897","guidance":"Real-time monitoring identifies a service control command targeting a critical Industrial Control System (ICS) services such as Open Platform Communications (OPC) server, historian, Supervisory Control and Data Acquisition (SCADA) polling from an account not in the authorized service administration role, without a preceding change-control ticket, immediately followed by the service transitioning to Stopped state. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.","url":"https://attack.mitre.org/detectionstrategies/DET0765#AN1897","platforms":["Windows"],"tuning":[{"field":"AuthorizedServiceAdmins","description":"Accounts authorized to stop/start critical ICS services."},{"field":"BulkRestartTimeWindow","description":"Time window within which multiple device restarts are considered a coordinated event."},{"field":"CriticalICSServiceList","description":"List of Windows services whose stoppage constitutes a high-impact event."},{"field":"EngineeringWorkstationList","description":"IP allowlist of workstations authorized to issue device restart commands."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1 sc.exe/net.exe invocation targeting a critical ICS service from an account outside the authorized service-administration set","platforms":["Windows"],"analytic_id":"AN1897","source_url":"https://attack.mitre.org/detectionstrategies/DET0765#AN1897","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0041","component":"Service Metadata","name":"WinEventLog:System","channel":"EventCode=7036 critical Industrial Control Systems (ICS) service transitions to Stopped without preceding change ticket reference","platforms":["Windows"],"analytic_id":"AN1897","source_url":"https://attack.mitre.org/detectionstrategies/DET0765#AN1897","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0041/"}]},{"id":"AN2140","name":"Analytic 2140","guidance":"Real-time monitoring identifies systemctl stop or kill commands targeting Industrial Control System (ICS) service processes on Linux assets, from a User Identifier (UID) that is not the ICS service owner or an authorized system administrator. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.","url":"https://attack.mitre.org/detectionstrategies/DET0765#AN2140","platforms":["Linux"],"tuning":[{"field":"AuthorizedServiceAdmins","description":"Accounts authorized to stop/start critical ICS services."},{"field":"BulkRestartTimeWindow","description":"Time window within which multiple device restarts are considered a coordinated event."},{"field":"CriticalICSServiceList","description":"List of Windows services whose stoppage constitutes a high-impact event."},{"field":"EngineeringWorkstationList","description":"IP allowlist of workstations authorized to issue device restart commands."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; systemctl/kill command targets a critical ICS service from a UID not in the authorized service-administration set","platforms":["Linux"],"analytic_id":"AN2140","source_url":"https://attack.mitre.org/detectionstrategies/DET0765#AN2140","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN2195","name":"Analytic 2195","guidance":"Real-time monitoring identifies Simple Network Management Protocol (SNMP) SET commands to service-stop Object Identifiers (OIDs) or Command Line Interface (CLI) commands stopping routing/switching processes critical to Industrial Control System (ICS) communication, from sources not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.","url":"https://attack.mitre.org/detectionstrategies/DET0765#AN2195","platforms":["Network Devices"],"tuning":[{"field":"AuthorizedServiceAdmins","description":"Accounts authorized to stop/start critical ICS services."},{"field":"BulkRestartTimeWindow","description":"Time window within which multiple device restarts are considered a coordinated event."},{"field":"CriticalICSServiceList","description":"List of Windows services whose stoppage constitutes a high-impact event."},{"field":"EngineeringWorkstationList","description":"IP allowlist of workstations authorized to issue device restart commands."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"networkdevice:syslog","channel":"Simple Network Management Protocol (SNMP) SET to service stop Object Identifier (OID) or Command Line Interface (CLI) command stopping critical service from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet","platforms":["Network Devices"],"analytic_id":"AN2195","source_url":"https://attack.mitre.org/detectionstrategies/DET0765#AN2195","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]},{"id":"AN2230","name":"Analytic 2230","guidance":"Real-time monitoring identifies an Industrial Control System (ICS) protocol restart command directed at a field device from a source not in the approved engineering workstation list, where multiple devices receive restart commands within a short window. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.","url":"https://attack.mitre.org/detectionstrategies/DET0765#AN2230","platforms":["Embedded"],"tuning":[{"field":"AuthorizedServiceAdmins","description":"Accounts authorized to stop/start critical ICS services."},{"field":"BulkRestartTimeWindow","description":"Time window within which multiple device restarts are considered a coordinated event."},{"field":"CriticalICSServiceList","description":"List of Windows services whose stoppage constitutes a high-impact event."},{"field":"EngineeringWorkstationList","description":"IP allowlist of workstations authorized to issue device restart commands."}],"log_sources":[{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Content","channel":"restart/reset service from source not in engineering workstation list, with more than one device receiving the command within bulk restart time window","platforms":["Embedded"],"analytic_id":"AN2230","source_url":"https://attack.mitre.org/detectionstrategies/DET0765#AN2230","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0041","name":"Service Metadata","tag":"Service Metadata","page":"telemetry/DC0041/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0496","name":"REvil","url":"https://attack.mitre.org/software/S0496","kind":"malware","description":"[REvil](https://attack.mitre.org/software/S0496) searches for all processes listed in the prc field within its configuration file and then terminates each process. (Citation: McAfee Labs October 2019)","relationship_id":"relationship--309e4558-e591-4d03-9bb9-07d30acf011f","references":[{"source_name":"McAfee Labs October 2019","description":"McAfee Labs 2019, October 02 McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service  What The Code Tells Us Retrieved. 2021/04/12 ","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us"}]},{"id":"S0604","name":"Industroyer","url":"https://attack.mitre.org/software/S0604","kind":"malware","description":"[Industroyer](https://attack.mitre.org/software/S0604) has the capability to stop a service itself, or to login as a user and stop a service as that user. (Citation: Anton Cherepanov, ESET June 2017)","relationship_id":"relationship--66f79019-d52c-46a6-b605-c2335d1d3d20","references":[{"source_name":"Anton Cherepanov, ESET June 2017","description":"Anton Cherepanov, ESET 2017, June 12 Win32/Industroyer: A new threat for industrial control systems Retrieved. 2017/09/15 ","url":"https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"}]},{"id":"S0605","name":"EKANS","url":"https://attack.mitre.org/software/S0605","kind":"malware","description":"Before encrypting the process, [EKANS](https://attack.mitre.org/software/S0605) first kills the process if its name matches one of the processes defined on the kill-list.  (Citation: Daniel Kapellmann Zafra, Keith Lunden, Nathan Brubaker, Jeremy Kennelly July 2020) (Citation: Daniel Kapellmann Zafra, Keith Lunden, Nathan Brubaker, Jeremy Kennelly July 2020) EKANS also utilizes netsh commands to implement firewall rules that blocks any remote communication with the device. (Citation: Ben Hunter and Fred Gutierrez July 2020)","relationship_id":"relationship--11e4eb54-b0b3-4f67-a93f-28cc10df00ab","references":[{"source_name":"Ben Hunter and Fred Gutierrez July 2020","description":"Ben Hunter and Fred Gutierrez 2020, July 01 EKANS Ransomware Targeting OT ICS Systems Retrieved. 2021/04/12 ","url":"https://www.fortinet.com/blog/threat-research/ekans-ransomware-targeting-ot-ics-systems"},{"source_name":"Daniel Kapellmann Zafra, Keith Lunden, Nathan Brubaker, Jeremy Kennelly July 2020","description":"Daniel Kapellmann Zafra, Keith Lunden, Nathan Brubaker, Jeremy Kennelly 2020, July 15 Ransomware Against the Machine: How Adversaries are Learning to Disrupt Industrial Production by Targeting IT and OT Retrieved. 2021/04/12 ","url":"https://www.fireeye.com/blog/threat-research/2020/02/ransomware-against-machine-learning-to-disrupt-industrial-production.html"}]},{"id":"S0607","name":"KillDisk","url":"https://attack.mitre.org/software/S0607","kind":"malware","description":"[KillDisk](https://attack.mitre.org/software/S0607) looks for and terminates two non-standard processes, one of which is an ICS application. (Citation: Anton Cherepanov)","relationship_id":"relationship--b452a076-6d4e-49f5-95ac-16264ef05b1d","references":[{"source_name":"Anton Cherepanov","description":"Anton Cherepanov   BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry Retrieved. 2019/10/29 ","url":"https://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"}]},{"id":"S1072","name":"Industroyer2","url":"https://attack.mitre.org/software/S1072","kind":"malware","description":"[Industroyer2](https://attack.mitre.org/software/S1072) has the capability to terminate specified processes (i.e., PServiceControl.exe and PService_PDD.exe) and rename each process to prevent restart. These are defined through a hardcoded configuration.(Citation: Industroyer2 Mandiant April 2022)","relationship_id":"relationship--54a977df-ca85-43b2-b2bc-96fdcd23aa9b","references":[{"source_name":"Industroyer2 Mandiant April 2022","description":"Daniel Kapellmann Zafra, Raymond Leong, Chris Sistrunk, Ken Proska, Corey Hildebrandt, Keith Lunden, Nathan Brubaker. (2022, April 25). INDUSTROYER.V2: Old Malware Learns New Tricks. Retrieved March 30, 2023.","url":"https://www.mandiant.com/resources/blog/industroyer-v2-old-malware-new-tricks"}]}],"actors":[],"mitigations":[{"id":"M0918","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M0918","kind":"course-of-action","description":"Limit privileges of user accounts and groups so that only authorized administrators can change service states and configurations.\n","relationship_id":"relationship--01b4a92f-da42-4dfa-8d59-53709b65940e","references":[]},{"id":"M0922","name":"Restrict File and Directory Permissions","url":"https://attack.mitre.org/mitigations/M0922","kind":"course-of-action","description":"Ensure proper process and file permissions are in place to inhibit adversaries from disabling or interfering with critical services.\n","relationship_id":"relationship--6833d534-9cbb-4b9f-85b6-93d3d2d6faca","references":[]},{"id":"M0924","name":"Restrict Registry Permissions","url":"https://attack.mitre.org/mitigations/M0924","kind":"course-of-action","description":"Ensure proper registry permissions are in place to inhibit adversaries from disabling or interfering with critical services.\n","relationship_id":"relationship--0e4f272b-d744-4feb-9f3f-c24c3598538f","references":[]},{"id":"M0930","name":"Network Segmentation","url":"https://attack.mitre.org/mitigations/M0930","kind":"course-of-action","description":"Segment operational network and systems to restrict access to critical system functions to predetermined management systems. (Citation: Department of Homeland Security September 2016)\n","relationship_id":"relationship--9cca3120-c95e-4f5e-bc4b-0521ab5cc512","references":[{"source_name":"Department of Homeland Security September 2016","description":"Department of Homeland Security 2016, September Retrieved. 2020/09/25 ","url":"https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"}]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T0881":"/ttp-simulation/techniques/ics/T0881/","T1489":"/ttp-simulation/techniques/enterprise/T1489/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"ics/T0881","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0041","collector":"illustrative-lab-collector","observation":{"service":"LabService","executable":"C:\\Lab\\service.exe","start_mode":"manual","state":"stopped"}}]}}