Service Stop (T1489) — ATT&CK

Events covered

20 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 5	Process terminated
Sysmon	Event ID 12	RegistryEvent (Object create and delete)
Sysmon	Event ID 13	RegistryEvent (Value Set)
Sysmon	Event ID 14	RegistryEvent (Key and Value Rename)
Security-Auditing	Event ID 4656	A handle to an object was requested.
Security-Auditing	Event ID 4688	A new process has been created.
Defender-IdentityInfo	any	Identity information
ESF	signal	Signal Delivery
Linux-Auditd	Event ID 1131	SERVICE_STOP
Linux-Auditd	Event ID 1302	PATH
Linux-Auditd	Event ID 1307	CWD
PowerShell	Event ID 4103	Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).
TaskScheduler	Event ID 141	User "TaskName" deleted Task Scheduler task "Name".
TaskScheduler	Event ID 142	User "TaskName" disabled Task Scheduler task "Name".
MsiInstaller	Event ID 1034	Product: Data_0.
MsiInstaller	Event ID 11724	Event ID 11724
Service-Control-Manager	Event ID 7040	The start type of the msdsm service was changed from boot start to demand start.
Sysmon-for-Linux	Event ID 1	Process Create

Authoring guide

These 85 rules share fields, values, and exclusions.

Fields filtered most (64 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`CommandLine`	24	`contains` 22, `ends_with` 2, `regex_match` 2, `match` 1	`stop` , `stop`, `\Windows\BitLocker`, `sc`, `-f`
`process_basename`	17	`eq` 11, `in` 8	`sc.exe`, `chkconfig`, `service`, `systemctl`, `net1.exe`
`EventType`	15	`eq` 9, `in` 4, `wildcard` 2, `starts_with` 1	`exec`, `exec_event`, `ProcessRollup2`, `DeleteFunction`, `DeleteFunction20*`
`Image`	14	`ends_with` 14	`\sc.exe`, `\schtasks.exe`, `\net.exe`, `\net1.exe`, `\taskkill.exe`
`OriginalFileName`	11	`eq` 11	`net1.exe`, `sc.exe`, `PowerShell.EXE`, `net.exe`, `schtasks.exe`
`data_stream.dataset`	10	`eq` 10	`azure.activitylogs`, `aws.cloudtrail`, `gcp.audit`, `okta.system`
`event.type`	10	`eq` 10	`start`, `change`, `end`
`operationName`	9	`eq` 9	`Delete administrative unit`, `Delete application`, `Hard Delete application`, `MICROSOFT.COMPUTE/VIRTUALMACHINES/DELETE`, `MICROSOFT.CONTAINERREGISTRY/REGISTRIES/DELETE`
`EventID`	7	`eq` 7	`4656`, `4688`, `1`, `4103`, `4104`
`process.args`	7	`eq` 5, `in` 5	`disable`, `--delete-chain`, `--flush`, `-9`, `-F`
`type`	7	`eq` 7, `regex_match` 1	`SERVICE_STOP`, `PATH`, `(?i)(service_stop)`, `CWD`, `service_stop`
`event.outcome`	6	`eq` 6	`success`, `Success`
`sourcetype`	6	`eq` 6	`auditd`, `ollama:server`
`azure.activitylogs.operation_name`	4	`eq` 4	`MICROSOFT.STORAGE/STORAGEACCOUNTS/DELETE`, `MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/PODS/DELETE`, `MICROSOFT.RESOURCES/SUBSCRIPTIONS/RESOURCEGROUPS/DELETE`
`Provider_Name`	3	`eq` 3	`MsiInstaller`, `events.amazonaws.com`, `lambda.amazonaws.com`

Top indicator values (603 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.outcome`	`eq`	`Success` elasticAWS EventBridge Rule Disabled or Deleted elasticAWS Lambda Function Deletion elasticAzure Kubernetes Services (AKS) Kubernetes Pods Deleted elasticAzure Resource Group Deleted elasticGCP Pub/Sub Subscription Deletion elasticGCP Pub/Sub Topic Deletion	6	306
`CommandLine`	`contains`	`stop` sigmaDisable Or Stop Services sigmaStop Windows Service Via Net.EXE sigmaStop Windows Service Via Sc.EXE sigmaSuspicious Windows Service Tampering splunkWindows Service Stop Attempt	5	8
`CommandLine`	`contains`	`stop` sigmamacOS Service Disruption Activity sigmaMassive services termination burst splunkLinux Stop Services splunkWindows Excessive Service Stop Attempt	4	8
`CommandLine`	`contains`	`Stop-Service ` sigmaStop Windows Service Via PowerShell Stop-Service sigmaSuspicious Windows Service Tampering splunkWindows Service Stop Attempt	3	4
`CommandLine`	`contains`	`config` sigmaService deactivation (command) sigmaSuspicious Windows Service Tampering splunkExcessive Attempt To Disable Services	3	16
`Image`	`ends_with`	`\sc.exe` sigmaMassive services deletion burst sigmaMassive services termination burst sigmaService deactivation (command) sigmaStop Windows Service Via Sc.EXE sigmaSuspicious Windows Service Tampering	5	30
`Image`	`ends_with`	`\net.exe` sigmaMassive services termination burst sigmaStop Windows Service Via Net.EXE sigmaSuspicious Windows Service Tampering	3	49
`Image`	`ends_with`	`\net1.exe` sigmaMassive services termination burst sigmaStop Windows Service Via Net.EXE sigmaSuspicious Windows Service Tampering	3	47
`Image`	`ends_with`	`\schtasks.exe` sigmaDelete All Scheduled Tasks sigmaDelete Important Scheduled Task sigmaDisable Important Scheduled Task	3	55
`OriginalFileName`	`eq`	`net1.exe` sigmaStop Windows Service Via Net.EXE sigmaSuspicious Windows Service Tampering splunkWindows Excessive Service Stop Attempt splunkWindows Service Stop Attempt splunkWindows Set Account Password Policy To Unlimited Via Net	5	39
`OriginalFileName`	`eq`	`sc.exe` sigmaStop Windows Service Via Sc.EXE sigmaSuspicious Windows Service Tampering splunkWindows Excessive Service Stop Attempt splunkWindows Service Stop Attempt splunkWindows Service Stop By Deletion	5	28
`event.type`	`eq`	`start` elasticAttempt to Disable Auditd Service elasticAttempt to Disable IPTables or Firewall elasticAttempt to Disable Syslog Service elasticElastic Agent Service Terminated elasticProcess Killing Detected via Defend for Containers	5	1036
`event.type`	`eq`	`start` elasticHigh Number of Process and/or Service Terminations elasticHigh Number of Process Terminations elasticKill Command Execution	3	67
`process_basename`	`eq`	`sc.exe` elasticElastic Agent Service Terminated splunkExcessive Attempt To Disable Services splunkWindows Excessive Service Stop Attempt splunkWindows Service Stop Attempt splunkWindows Service Stop By Deletion	5	32
`process_basename`	`eq`	`chkconfig` elasticAttempt to Disable Auditd Service elasticAttempt to Disable IPTables or Firewall elasticAttempt to Disable Syslog Service	3	7
`process_basename`	`eq`	`net1.exe` splunkWindows Excessive Service Stop Attempt splunkWindows Service Stop Attempt splunkWindows Set Account Password Policy To Unlimited Via Net	3	40
`sourcetype`	`eq`	`auditd` splunkLinux Auditd Auditd Service Stop splunkLinux Auditd Osquery Service Stop splunkLinux Auditd Stop Services splunkLinux Auditd Sysmon Service Stop splunkLinux Magic SysRq Key Abuse	5	58
`type`	`eq`	`SERVICE_STOP` splunkLinux Auditd Auditd Service Stop splunkLinux Auditd Osquery Service Stop splunkLinux Auditd Stop Services splunkLinux Auditd Sysmon Service Stop splunkService Stop Commands	5	7
`data_stream.dataset`	`eq`	`azure.activitylogs` elasticAzure Kubernetes Services (AKS) Kubernetes Pods Deleted elasticAzure Resource Group Deleted elasticAzure Storage Account Deletion by Unusual User elasticAzure Storage Account Deletions by User	4	38
`process.args`	`in`	`kill` elasticAttempt to Disable Auditd Service elasticAttempt to Disable IPTables or Firewall elasticAttempt to Disable Syslog Service elasticProcess Killing Detected via Defend for Containers	4	8
`process.args`	`in`	`disable` elasticAttempt to Disable Auditd Service elasticAttempt to Disable IPTables or Firewall elasticAttempt to Disable Syslog Service	3	7
`process.args`	`in`	`mask` elasticAttempt to Disable Auditd Service elasticAttempt to Disable IPTables or Firewall elasticAttempt to Disable Syslog Service	3	6
`process.args`	`in`	`remove` elasticAttempt to Disable Auditd Service elasticAttempt to Disable IPTables or Firewall elasticAttempt to Disable Syslog Service	3	6
`process.args`	`in`	`stop` elasticAttempt to Disable Auditd Service elasticAttempt to Disable IPTables or Firewall elasticAttempt to Disable Syslog Service	3	7
`EventType`	`in`	`exec` elasticAttempt to Disable Auditd Service elasticAttempt to Disable IPTables or Firewall elasticAttempt to Disable Syslog Service	3	180
`EventType`	`in`	`exec_event` elasticAttempt to Disable Auditd Service elasticAttempt to Disable IPTables or Firewall elasticAttempt to Disable Syslog Service	3	135
`EventType`	`in`	`start` elasticAttempt to Disable Auditd Service elasticAttempt to Disable IPTables or Firewall elasticAttempt to Disable Syslog Service	3	157
`event.category`	`eq`	`process` elasticHigh Number of Process and/or Service Terminations elasticHigh Number of Process Terminations elasticKill Command Execution	3	105
`process.args`	`eq`	`off` elasticAttempt to Disable Auditd Service elasticAttempt to Disable IPTables or Firewall elasticAttempt to Disable Syslog Service	3	7
`process.args`	`eq`	`stop` elasticAttempt to Disable Auditd Service elasticAttempt to Disable IPTables or Firewall elasticAttempt to Disable Syslog Service	3	7

Exclusions (41 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`aws::userAgent`	`contains`	`Pulumi` elasticAWS EventBridge Rule Disabled or Deleted elasticAWS Lambda Function Deletion	2
`aws::userAgent`	`contains`	`Terraform` elasticAWS EventBridge Rule Disabled or Deleted elasticAWS Lambda Function Deletion	2
`CommandLine`	`contains`	`stop` sigmaDisable Or Stop Services	1
`CommandLine`	`contains`	`stop snap-snapd-` sigmaDisable Or Stop Services	1
`CommandLine`	`contains`	`--no-reload disable snap-snapd-` sigmaDisable Or Stop Services	1
`CommandLine`	`contains`	`ssh.` sigmaDisable Or Stop Services	1
`CommandLine`	`ends_with`	`snap.amazon-ssm-agent.amazon-ssm-agent.service` sigmaDisable Or Stop Services	1
`Image`	`ends_with`	`/systemctl` sigmaDisable Or Stop Services	1
`ParentCommandLine`	`contains`	`/dpkg/info/ubuntu-pro-client.prerm upgrade` sigmaDisable Or Stop Services	1
`ParentCommandLine`	`contains`	`tmp.ci/preinst upgrade` sigmaDisable Or Stop Services	1
`ParentCommandLine`	`eq`	`runc init` elasticKill Command Execution	1
`ParentImage`	`contains`	`:\Windows\Temp` sigmaProcess Terminated Via Taskkill	1
`ParentImage`	`contains`	`\AppData\Local\Temp\` sigmaProcess Terminated Via Taskkill	1
`ParentImage`	`ends_with`	`.tmp` sigmaProcess Terminated Via Taskkill	1
`ParentImage`	`in`	`/bin/xargs` elasticKill Command Execution	1

Service Stop `T1489`

Events covered

Authoring guide

Fields filtered most (64 distinct)

Top indicator values (603 distinct)

Exclusions (41 distinct)

Rules under this technique

Sigma 26 rules

Elastic 21 rules

Splunk 23 rules

Kusto 11 rules

YARA-L 1 rule

Panther 3 rules

Service Stop T1489

Events covered

Authoring guide

Fields filtered most (64 distinct)

Top indicator values (603 distinct)

Exclusions (41 distinct)

Rules under this technique

Sigma 26 rules

Elastic 21 rules

Splunk 23 rules

Kusto 11 rules

YARA-L 1 rule

Panther 3 rules

Service Stop `T1489`