T1489 — Service Stop

Tactic: Impact · Platforms: ESXi, IaaS, Linux, macOS, Windows

Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment. Adversaries may…

Sigma detection rules (4)

T1489 Service Stop

title: T1489 Service Stop
id: d775c8a9-9282-4846-aab2-4ccea0fbb21f
description: 'Behavioral Detection for Service Stop via command-line tools (sc.exe, net.exe/net1.exe, PowerShell Stop-Service) used to stop Windows services. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, ServiceName, ParentProcess.'
references:
  - https://attack.mitre.org/techniques/T1489
author: Shahrukh Khan
date: 2026-03-26
license: MIT
tags:
  - attack.impact
  - attack.t1489

logsource:
  category: process_creation
  product: windows

detection:
  selection_sc:
    Image|endswith: '\sc.exe'
    CommandLine|contains: 'stop'
  selection_net:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
    CommandLine|contains: 'stop'
  selection_ps:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains: 'Stop-Service'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: 1 of selection_* and not filter_system_account

falsepositives:
  - Administrators or maintenance/patching scripts legitimately stopping services; System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with ServiceName allowlists if noise remains.

level: medium

T1489 Service Stop

title: T1489 Service Stop
id: a9e214e6-2644-4f63-aa6d-aa27f1e7f58b
description: 'Behavioral Detection for Service Stop across Platforms. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TimeWindow, ExecUser.'
references:
  - https://attack.mitre.org/techniques/T1489
author: Shahrukh Khan
date: 2026-06-04
license: MIT
tags:
  - attack.impact
  - attack.t1489

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/systemctl'
      - '/service'
    a1|contains|all:
      - 'stop'

  condition: selection

falsepositives:
  - Routine, change-managed service stops by ops/deploy tooling; scope ExecUser to non-admin/unexpected accounts for higher fidelity.

level: medium

T1489 Service Stop

title: T1489 Service Stop
id: ec1967c9-3f4f-4bd9-b867-83a23c933bf6
description: 'Behavioral Detection for Service Stop across Platforms. stop/delete are flagged without an argument-value constraint; scale is only flagged when paired with a --replicas=0 (or split "--replicas 0") argument, since a bare "0" elsewhere in argv is not a meaningful signal for stop/delete. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ServiceLabel, LaunchType.'
references:
  - https://attack.mitre.org/techniques/T1489
author: Shahrukh Khan
date: 2026-04-13
license: MIT
tags:
  - attack.impact
  - attack.t1489

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_stop_delete:
    type: EXECVE
    a0|endswith:
      - '/docker'
      - '/kubectl'
    a1|contains:
      - 'stop'
      - 'delete'
  selection_scale_zero_eq:
    type: EXECVE
    a0|endswith: '/kubectl'
    a1|contains: 'scale'
    a2|contains: '--replicas=0'
  selection_scale_zero_eq2:
    type: EXECVE
    a0|endswith: '/kubectl'
    a1|contains: 'scale'
    a3|contains: '--replicas=0'
  selection_scale_zero_eq3:
    type: EXECVE
    a0|endswith: '/kubectl'
    a1|contains: 'scale'
    a4|contains: '--replicas=0'
  selection_scale_zero_sp1:
    type: EXECVE
    a0|endswith: '/kubectl'
    a1|contains: 'scale'
    a3|contains: '--replicas'
    a4: '0'
  selection_scale_zero_sp2:
    type: EXECVE
    a0|endswith: '/kubectl'
    a1|contains: 'scale'
    a4|contains: '--replicas'
    a5: '0'

  condition: 1 of selection_*

falsepositives:
  - Legitimate container/pod scale-down or rolling restarts as part of normal deployment operations, or stop/delete of containers/pods during routine deployment; the ServiceLabel/LaunchType tuning fields need orchestration-layer (Kubernetes API audit log) context, not just host auditd.

level: medium

T1489 Service Stop

title: T1489 Service Stop
id: a00f35e0-976f-435d-a7ec-f92e6cb776ac
description: 'Behavioral Detection for Service Stop across Platforms. (Retargeted to the process_termination ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: VMName, InitiatorUser.'
references:
  - https://attack.mitre.org/techniques/T1489
author: Shahrukh Khan
date: 2026-04-12
license: MIT
tags:
  - attack.impact
  - attack.t1489

logsource:
  category: process_termination
  product: esxi
  service: shell

detection:
  selection:
    CommandLine|contains:
      - 'vim-cmd vmsvc/power.off'
      - 'vim-cmd vmsvc/power.shutdown'
      - 'esxcli vm process kill'

  condition: selection

falsepositives:
  - Administrators or automation intentionally powering off or killing hung VMs during maintenance; volume and VMName should be checked against expected InitiatorUser to distinguish mass-stop ransomware precursor activity from routine operations.

level: high

Explore