T1668 — Exclusive Control

Tactic: Persistence · Platforms: Linux, macOS, Windows

Adversaries who successfully compromise a system may attempt to maintain persistence by “closing the door” behind them – in other words, by preventing other threat actors from initially accessing or maintaining a foothold on the same system. For example, adversaries may patch a vulnerable,…

Sigma detection rules (3)

title: T1668 Exclusive Control
id: 60c0d68b-3d17-4c25-9256-b871dd986dd3
description: 'Detection Strategy for Exclusive Control (T1668): flags an adversary disabling or stopping security, remote-access, or other competing-malware services after gaining a foothold, in order to "close the door" behind them and block other threat actors from using the same access. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: ServiceList, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1668
author: Shahrukh Khan
date: 2026-06-05
license: MIT
tags:
  - attack.persistence
  - attack.t1668

logsource:
  category: process_creation
  product: windows

detection:
  selection_sc_disable:
    Image|endswith: '\sc.exe'
    CommandLine|contains|all:
      - 'config'
      - 'disabled'
  selection_net_stop:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
    CommandLine|contains: 'stop'
  selection_target_service:
    CommandLine|contains:
      - 'WinDefend'
      - 'Sense'
      - 'SecurityHealthService'
      - 'wuauserv'
      - 'RemoteRegistry'
      - 'TermService'
      - 'MpsSvc'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: (selection_sc_disable or selection_net_stop) and selection_target_service and not filter_system_account

falsepositives:
  - Authorized IT/security-team maintenance disabling or restarting these services; System and service accounts performing the same action are excluded via filter_system_account; tune the target service list (ServiceList) for the environment.

level: medium

title: T1668 Exclusive Control
id: b9b0230f-13c2-4985-a84c-5f36fb641af6
description: 'Detection Strategy for Exclusive Control - an adversary hindering OTHER threat actors to maintain sole access to a compromised system. The prior version detected killing EDR/monitoring agents (falco, auditd, wazuh, crowdstrike), which is Impair Defenses (T1562.001) - defending against the victim organization''s own tooling, not locking out competing adversaries. Retargeted to two behaviors the technique actually describes: (1) termination of known competing malware/coinminer/botnet process names, and (2) revocation of another local user account''s privileged access (removal from the sudo/wheel group, or deletion of another user''s SSH authorized_keys entries), consistent with an adversary closing the door behind them against rival intruders. Tune using: KnownMalwareProcessNames, ProtectedAccountList.'
references:
  - https://attack.mitre.org/techniques/T1668
author: Shahrukh Khan
date: 2026-04-02
license: MIT
tags:
  - attack.persistence
  - attack.t1668

logsource:
  category: process_creation
  product: linux

detection:
  selection_kill_tools:
    type: EXECVE
    a0|endswith:
      - '/kill'
      - '/pkill'
      - '/killall'
  selection_rival_malware:
    a1|contains:
      - 'xmrig'
      - 'kinsing'
      - 'kdevtmpfsi'
      - 'moneroocean'
      - 'watchdog'
  selection_group_revoke:
    type: EXECVE
    a0|endswith:
      - '/gpasswd'
      - '/deluser'
      - '/usermod'
    a1|contains:
      - '-d'
      - '--del-user'
      - '-G'
    a2|contains:
      - 'sudo'
      - 'wheel'

  condition: (selection_kill_tools and selection_rival_malware) or selection_group_revoke

falsepositives:
  - Legitimate administrators cleaning up known cryptomining infections during incident response, or intentionally revoking a departing employee's sudo access; scope ProtectedAccountList to accounts that should never lose privileged access outside a documented offboarding process.

level: high

title: T1668 Exclusive Control
id: 7bcffbd8-d5a2-4cc5-80b3-c1e1ffa33cd0
description: 'Detection Strategy for Exclusive Control. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ProtectedServiceList.'
references:
  - https://attack.mitre.org/techniques/T1668
author: Shahrukh Khan
date: 2026-04-20
license: MIT
tags:
  - attack.persistence
  - attack.t1668

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/launchctl'
    CommandLine|contains:
      - 'unload'
      - 'disable'
  selection_scope:
    CommandLine|contains: 'com.apple.'

  condition: selection and selection_scope

falsepositives:
  - IT staff intentionally disabling a specific Apple daemon as part of an approved hardening or troubleshooting procedure.

level: high

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1668 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan