T1489 Service Stop
Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster) Adversaries may accomplish this by disabling…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Delete All Scheduled Taskshightest · windows
- Delete Important Scheduled Taskhightest · windows
- Disable Important Scheduled Taskhightest · windows
- Important Scheduled Task Deleted or Disabledhightest · windows
- Suspicious Windows Service Tamperinghightest · windows
- Azure Application Deletedmediumtest · azure
- Azure Kubernetes Network Policy Changemediumtest · azure
- Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deletedmediumtest · azure
- Azure Kubernetes Secret or Config Object Accessmediumtest · azure
- Azure Kubernetes Sensitive Role Accessmediumtest · azure
- Azure Kubernetes Service Account Modified or Deletedmediumtest · azure
- Disable Or Stop Servicesmediumtest · linux
- Potential Abuse of Linux Magic System Request Keymediumexperimental · linux
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.