T1489 Service Stop
Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster) Adversaries may accomplish this by disabling…
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
- Delete All Scheduled Taskshightest · windows
- Delete Important Scheduled Taskhightest · windows
- Disable Important Scheduled Taskhightest · windows
- Important Scheduled Task Deleted or Disabledhightest · windows
- Suspicious Windows Service Tamperinghightest · windows
- Azure Application Deletedmediumtest · azure
- Azure Kubernetes Network Policy Changemediumtest · azure
- Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deletedmediumtest · azure
- Azure Kubernetes Secret or Config Object Accessmediumtest · azure
- Azure Kubernetes Sensitive Role Accessmediumtest · azure
- Azure Kubernetes Service Account Modified or Deletedmediumtest · azure
- Disable Or Stop Servicesmediumtest · linux
- Potential Abuse of Linux Magic System Request Keymediumexperimental · linux
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.