CircleCI Atomic Red Team doc generator
80 lines
2.9 KiB
Markdown
80 lines
2.9 KiB
Markdown
# T1489 - Service Stop
|
|
## [Description from ATT&CK](https://attack.mitre.org/wiki/Technique/T1489)
|
|
<blockquote>Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster)
|
|
|
|
Adversaries may accomplish this by disabling individual services of high importance to an organization, such as <code>MSExchangeIS</code>, which will make Exchange content inaccessible (Citation: Novetta Blockbuster). In some cases, adversaries may stop or disable many or all services to render systems unusable.(Citation: Talos Olympic Destroyer 2018) Services may not allow for modification of their data stores while running. Adversaries may stop services in order to conduct [Data Destruction](https://attack.mitre.org/techniques/T1485) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) on the data stores of services like Exchange and SQL Server.(Citation: SecureWorks WannaCry Analysis)</blockquote>
|
|
|
|
## Atomic Tests
|
|
|
|
- [Atomic Test #1 - Windows - Stop service using Service Controller](#atomic-test-1---windows---stop-service-using-service-controller)
|
|
|
|
- [Atomic Test #2 - Windows - Stop service using net.exe](#atomic-test-2---windows---stop-service-using-netexe)
|
|
|
|
- [Atomic Test #3 - Windows - Stop service by killing process](#atomic-test-3---windows---stop-service-by-killing-process)
|
|
|
|
|
|
<br/>
|
|
|
|
## Atomic Test #1 - Windows - Stop service using Service Controller
|
|
Stops a specified service using the sc.exe command.
|
|
|
|
**Supported Platforms:** Windows
|
|
|
|
|
|
#### Inputs
|
|
| Name | Description | Type | Default Value |
|
|
|------|-------------|------|---------------|
|
|
| service_name | Name of a service to stop | String | spooler|
|
|
|
|
#### Run it with `command_prompt`! Elevation Required (e.g. root or admin)
|
|
```
|
|
sc.exe stop #{service_name}
|
|
```
|
|
|
|
|
|
|
|
<br/>
|
|
<br/>
|
|
|
|
## Atomic Test #2 - Windows - Stop service using net.exe
|
|
Stops a specified service using the net.exe command.
|
|
|
|
**Supported Platforms:** Windows
|
|
|
|
|
|
#### Inputs
|
|
| Name | Description | Type | Default Value |
|
|
|------|-------------|------|---------------|
|
|
| service_name | Name of a service to stop | String | spooler|
|
|
|
|
#### Run it with `command_prompt`! Elevation Required (e.g. root or admin)
|
|
```
|
|
net.exe stop #{service_name}
|
|
```
|
|
|
|
|
|
|
|
<br/>
|
|
<br/>
|
|
|
|
## Atomic Test #3 - Windows - Stop service by killing process
|
|
Stops a specified service killng the service's process.
|
|
This technique was used by WannaCry.
|
|
|
|
**Supported Platforms:** Windows
|
|
|
|
|
|
#### Inputs
|
|
| Name | Description | Type | Default Value |
|
|
|------|-------------|------|---------------|
|
|
| process_name | Name of a process to kill | String | sqlwriter.exe|
|
|
|
|
#### Run it with `command_prompt`!
|
|
```
|
|
taskkill.exe /f /im #{process_name}
|
|
```
|
|
|
|
|
|
|
|
<br/>
|