T1489 Service Stop
Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. MITRE ATT&CK
2 programs on CmdID 9 Sigma rules T1489 on attack.mitre.org
Programs for it
Sigma rules tagged with it
Command lines CmdID reads as it
To delete all tasks from the schedule of the local computer, including tasks scheduled by other users. on the page for schtasks delete
schtasks /delete /tn * /fIdentifyStop a service on the local computer on the page for stop-service
Stop-Service -Name service_nameIdentifyStop a service by using the display name on the page for stop-service
Stop-Service -DisplayName "name"IdentifyStop a service that has dependent services on the page for stop-service
Stop-Service -Name service_name -Force -ConfirmIdentifyAdd details to your tab completion values on the page for Register-ArgumentCompleter
$s = {
param(
$commandName,
$parameterName,
$wordToComplete,
$commandAst,
$fakeBoundParameters
)
$services = Get-Service | Where-Object {
$_.Status -eq 'Running' -and $_.Name -like "$wordToComplete*"
}
$services | ForEach-Object {
New-Object -Type System.Management.Automation.CompletionResult -ArgumentList @(
$_.Name # completionText
$_.Name # listItemText
'ParameterValue' # resultType
$_.Name # toolTip
)
}
}
Register-ArgumentCompleter -CommandName Stop-Service -ParameterName Name -ScriptBlock $sIdentifyStop a service on the local computer on the page for Stop-Service
Stop-Service -Name "sysmonlog"IdentifyStop a service that has dependent services on the page for Stop-Service
Get-Service -Name "iisadmin" | Format-List -Property Name, DependentServices
Stop-Service -Name "iisadmin" -Force -ConfirmIdentifyAn example is here when CmdID’s reading of it names T1489: a Sigma rule it trips is tagged with it, or its abuse is documented as it.