Service Stop
(Redirected from Service Stop)
Jump to navigation
Jump to search
| Service Stop | |
|---|---|
| Technique | |
| ID | T0881 |
| Tactic | Impair Process Control |
| Data Sources | Process command-line parameters, Process monitoring, Windows Registry, API monitoring |
| Asset | Human-Machine Interface, Control Server, Data Historian, Engineering Workstation |
Description
Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.1
Services may not allow for modification of their data stores while running. Adversaries may stop services in order to conduct Data Destruction.1
Procedure Examples
- Industroyer has the capability to stop a service itself, or to login as a user and stop a service as that user.2
- KillDisk looks for and terminates two non-standard processes, one of which is an ICS application.3
Mitigations
- Network Segmentation - Segment operational network and systems to restrict access to critical system functions to predetermined management systems.4
- Restrict File and Directory Permissions - Ensure proper process and file permissions are in place to inhibit adversaries from disabling or interfering with critical services.
- Restrict Registry Permissions - Ensure proper registry permissions are in place to inhibit adversaries from disabling or interfering with critical services.
- User Account Management - Limit privileges of user accounts and groups so that only authorized administrators can change service states and configurations.
References
