1. Home
  2. Techniques
  3. Enterprise
  4. 服务停止

服务停止

ID Name
T1489.001 服务维护操作模拟
T1489.002 合法工具滥用
T1489.003 间歇性服务干扰

服务停止是攻击者通过终止关键系统服务破坏目标业务连续性的破坏性技术，通常用于阻碍应急响应、加剧系统瘫痪或为数据破坏操作创造条件。传统防御手段通过监控服务控制事件（如SCM日志）、分析进程树异常、检测未授权服务配置变更等方式进行防护，依赖服务操作行为的合法性与合规性审查。

为规避传统检测机制对异常服务终止操作的识别能力，攻击者发展出多维度的服务停止匿迹技术，通过操作场景伪装、系统工具劫持、内存级攻击及状态震荡干扰等手法，将恶意服务控制行为深度融入正常系统运维活动中，形成"高隐蔽、强持续"的新型服务破坏范式。

现有服务停止匿迹技术的核心机理体现为对系统信任链条的深度渗透与多维特征的重构。攻击者通过模拟合法运维操作的时间模式和操作规范，规避基于操作时序异常的检测；利用系统管理组件的合法上下文执行攻击指令，突破基于进程行为分析的防护体系；采用内存级服务状态篡改技术，消除传统服务控制事件日志的生成；间歇性服务干扰技术通过自适应节奏控制，使攻击行为的时间分布特征与目标系统固有故障模式吻合。这些技术的共性在于突破服务管理的逻辑边界，通过系统内部信任关系的滥用、操作证据链的破坏以及攻击节奏的智能控制，实现服务终止行为的"合法化"与"隐形化"。

匿迹技术的演进导致传统基于日志审计、API监控的防御体系面临严峻挑战，防御方需构建内存行为监控、服务状态基线建模、长周期操作模式分析等新型检测能力，同时加强系统管理组件的完整性保护，建立服务运行状态的多维度交叉验证机制。

ID: T1489
Sub-techniques:  T1489.001, T1489.002, T1489.003
ⓘ
Tactic: 影响释放
ⓘ
Platforms: Linux, Windows, macOS
ⓘ
Impact Type: Availability
Version: 1.2
Created: 29 March 2019
Last Modified: 12 October 2024

匿迹效应

效应类型 是否存在
特征伪装 ✅
行为透明 ✅
数据遮蔽 ❌
时空释痕 ✅

特征伪装

攻击者通过精确模拟系统维护操作流程，使用合法管理工具和标准命令格式执行服务终止，使恶意操作在进程行为、命令参数等特征维度与正常运维活动完全一致。例如利用计划任务调度服务控制命令，并生成符合运维规范的虚假日志条目，实现攻击行为的表面合法化。

行为透明

利用合法系统工具或远程访问工具与Windows API交互，从而躲避防御者部署的常规异常检测。攻击者通过模拟合法工具使用场景，隐藏恶意行为，使检测系统难以识别出恶意破坏活动；通过远程访问工具执行服务停止操作，避免直接交互，躲避传统的安全防护措施或事件监控记录。由于攻击者的操作不通过常见的本地管理命令执行，这使得恶意活动的行为更加透明且难以察觉。

时空释痕

通过分布式攻击节点实施跨地域服务终止操作，单个节点仅破坏特定服务实例，且攻击间隔符合目标系统的正常维护周期。在间歇性服务干扰中，将集中式攻击拆解为长达数月的离散操作，这种时间维度上的特征稀释策略使防御方难以建立攻击事件的时间关联性，必须实施长周期行为模式分析才能识别恶意意图。

Procedure Examples

ID Name Description
S0640 Avaddon

Avaddon looks for and attempts to stop database processes.[1]
S1053 AvosLocker

AvosLocker has terminated specific processes before encryption.[2]
S0638 Babuk

Babuk can stop specific services related to backups.[3][4][5]
S1068 BlackCat

BlackCat has the ability to stop VM services on compromised networks.[6][7]
S1096 Cheerscrypt

Cheerscrypt has the ability to terminate VM processes on compromised hosts through execution of esxcli vm process kill.[8]
S0611 Clop

Clop can kill several processes and services related to backups and security solutions.[9][10]

S0575 Conti

Conti can stop up to 146 Windows services related to security, backup, database, and email solutions through the use of net stop.[11]
S0625 Cuba

Cuba has a hardcoded list of services and processes to terminate.[12]
S0659 Diavol

Diavol will terminate services using the Service Control Manager (SCM) API.[13]

S0605 EKANS

EKANS stops database, data backup solution, antivirus, and ICS-related processes.[14][15][16]
S0697 HermeticWiper

HermeticWiper has the ability to stop the Volume Shadow Copy service.[17]
S0431 HotCroissant

HotCroissant has the ability to stop services on the infected host.[18]
S1139 INC Ransomware

INC Ransomware can issue a command to kill a process on compromised hosts.[19]
G0119 Indrik Spider

Indrik Spider has used PsExec to stop services prior to the execution of ransomware.[20]
S0604 Industroyer

Industroyer’s data wiper module writes zeros into the registry keys in SYSTEM\CurrentControlSet\Services to render a system inoperable.[21]
S0607 KillDisk

KillDisk terminates various processes to get the user to reboot the victim machine.[22]
G1004 LAPSUS$

LAPSUS$ has shut down virtual machines from within a victim's on-premise VMware ESXi infrastructure.[23]
G0032 Lazarus Group

Lazarus Group has stopped the MSExchangeIS service to render Exchange contents inaccessible to users.[24]
S0582 LookBack

LookBack can kill processes and delete services.[25]
S0449 Maze

Maze has stopped SQL services to ensure it can encrypt any database.[26]

S0576 MegaCortex

MegaCortex can stop and disable services on the system.[27]

S0688 Meteor

Meteor can disconnect all network adapters on a compromised host using powershell -Command "Get-WmiObject -class Win32_NetworkAdapter | ForEach { If ($.NetEnabled) { $.Disable() } }" > NUL.[28]
S0457 Netwalker

Netwalker can terminate system processes and services, some of which relate to backup software.[29]
S0365 Olympic Destroyer

Olympic Destroyer uses the API call ChangeServiceConfigW to disable all services on the affected system.[30]
S0556 Pay2Key

Pay2Key can stop the MS SQL service at the end of the encryption process to release files locked by the service.[31]
S1058 Prestige

Prestige has attempted to stop the MSSQL Windows service to ensure successful encryption using C:\Windows\System32\net.exe stop MSSQLSERVER.[32]
S0583 Pysa

Pysa can stop services and processes.[33]

S0481 Ragnar Locker

Ragnar Locker has attempted to stop services associated with business applications and databases to release the lock on files used by these applications so they may be encrypted.[34]
S0496 REvil

REvil has the capability to stop services and kill processes.[35][36]
S1150 ROADSWEEP

ROADSWEEP can disable critical services and processes.[37]
S0400 RobbinHood

RobbinHood stops 181 Windows services on the system before beginning the encryption process.[38]

S1073 Royal

Royal can use RmShutDown to kill applications and services using the resources that are targeted for encryption.[39]
S0446 Ryuk

Ryuk has called kill.bat for stopping services, disabling services and killing processes.[40]
G0034 Sandworm Team

Sandworm Team attempts to stop the MSSQL Windows service to ensure successful encryption of locked files.[32]

S0533 SLOTHFULMEDIA

SLOTHFULMEDIA has the capability to stop processes and services.[41]
S0366 WannaCry

WannaCry attempts to kill processes associated with Exchange, Microsoft SQL Server, and MySQL to make it possible to encrypt their data stores.[42][43]
G0102 Wizard Spider

Wizard Spider has used taskkill.exe and net.exe to stop backup, catalog, cloud, and other services prior to network encryption.[44]

Mitigations

ID Mitigation Description
M1030 Network Segmentation

Operate intrusion detection, analysis, and response systems on a separate network from the production environment to lessen the chances that an adversary can see and interfere with critical response functions.
M1060 Out-of-Band Communications Channel

Develop and enforce security policies that include the use of out-of-band communication channels for critical communications during a security incident.[45]
M1022 Restrict File and Directory Permissions

Ensure proper process and file permissions are in place to inhibit adversaries from disabling or interfering with critical services.
M1024 Restrict Registry Permissions

Ensure proper registry permissions are in place to inhibit adversaries from disabling or interfering with critical services.
M1018 User Account Management

Limit privileges of user accounts and groups so that only authorized administrators can interact with service changes and service configurations.

Detection

ID Data Source Data Component Detects
DS0017 Command Command Execution

Monitor executed commands and arguments that may stop or disable services on a system to render those services unavailable to legitimate users.
DS0022 File File Modification

Monitor for changes made to files that may stop or disable services on a system to render those services unavailable to legitimate users.
DS0009 Process OS API Execution

Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. For example, ChangeServiceConfigW may be used by an adversary to prevent services from starting.[30]
Process Creation

Monitor for newly executed processes that may stop or disable services on a system to render those services unavailable to legitimate users.
Process Termination

Monitor processes and command-line arguments to see if critical processes are terminated or stop running.
DS0019 Service Service Metadata

Alterations to the service binary path or the service startup type changed to disabled may be suspicious.
DS0024 Windows Registry Windows Registry Key Modification

Monitor for changes made to windows registry keys and/or values that may stop or disable services on a system to render those services unavailable to legitimate users.

References

  1. Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.
  2. Hasherezade. (2021, July 23). AvosLocker enters the ransomware scene, asks for partners. Retrieved January 11, 2023.
  3. Sogeti. (2021, March). Babuk Ransomware. Retrieved August 11, 2021.
  4. Mundo, A. et al. (2021, February). Technical Analysis of Babuk Ransomware. Retrieved August 11, 2021.
  5. Centero, R. et al. (2021, February 5). New in Ransomware: Seth-Locker, Babuk Locker, Maoloa, TeslaCrypt, and CobraLocker. Retrieved August 11, 2021.
  6. Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.
  7. Brandt, Andrew. (2022, July 14). BlackCat ransomware attacks not merely a byproduct of bad luck. Retrieved December 20, 2022.
  8. Dela Cruz, A. et al. (2022, May 25). New Linux-Based Ransomware Cheerscrypt Targeting ESXi Devices Linked to Leaked Babuk Source Code. Retrieved December 19, 2023.
  9. Santos, D. (2021, April 13). Threat Assessment: Clop Ransomware. Retrieved July 30, 2021.
  10. Mundo, A. (2019, August 1). Clop Ransomware. Retrieved May 10, 2021.
  11. Baskin, B. (2020, July 8). TAU Threat Discovery: Conti Ransomware. Retrieved February 17, 2021.
  12. Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.
  13. Neeamni, D., Rubinfeld, A.. (2021, July 1). Diavol - A New Ransomware Used By Wizard Spider?. Retrieved November 12, 2021.
  14. Dragos. (2020, February 3). EKANS Ransomware and ICS Operations. Retrieved February 9, 2021.
  15. Zafra, D., et al. (2020, February 24). Ransomware Against the Machine: How Adversaries are Learning to Disrupt Industrial Production by Targeting IT and OT. Retrieved March 2, 2021.
  16. Hinchliffe, A. Santos, D. (2020, June 26). Threat Assessment: EKANS Ransomware. Retrieved February 9, 2021.
  17. Dani, M. (2022, March 1). Ukrainian Targets Hit by HermeticWiper, New Datawiper Malware. Retrieved March 25, 2022.
  18. Knight, S.. (2020, April 16). VMware Carbon Black TAU Threat Analysis: The Evolution of Lazarus. Retrieved May 1, 2020.
  19. Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.
  20. Symantec Threat Intelligence. (2020, June 25). WastedLocker: Symantec Identifies Wave of Attacks Against U.S. Organizations. Retrieved May 20, 2021.
  21. Dragos Inc.. (2017, June 13). CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations. Retrieved December 18, 2020.
  22. Gilbert Sison, Rheniel Ramos, Jay Yaneza, Alfredo Oliveira. (2018, January 15). KillDisk Variant Hits Latin American Financial Groups. Retrieved January 12, 2021.
  23. Brown, D., et al. (2022, April 28). LAPSUS$: Recent techniques, tactics and procedures. Retrieved December 22, 2022.
  1. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Destructive Malware Report. Retrieved March 2, 2016.
  2. Raggi, M. Schwarz, D.. (2019, August 1). LookBack Malware Targets the United States Utilities Sector with Phishing Attacks Impersonating Engineering Licensing Boards. Retrieved February 25, 2021.
  3. Brandt, A., Mackenzie, P.. (2020, September 17). Maze Attackers Adopt Ragnar Locker Virtual Machine Technique. Retrieved October 9, 2020.
  4. Del Fierro, C. Kessem, L.. (2020, January 8). From Mega to Giga: Cross-Version Comparison of Top MegaCortex Modifications. Retrieved February 15, 2021.
  5. Check Point Research Team. (2021, August 14). Indra - Hackers Behind Recent Attacks on Iran. Retrieved February 17, 2022.
  6. Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.
  7. Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.
  8. Check Point. (2020, November 6). Ransomware Alert: Pay2Key. Retrieved January 4, 2021.
  9. MSTIC. (2022, October 14). New “Prestige” ransomware impacts organizations in Ukraine and Poland. Retrieved January 19, 2023.
  10. CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.
  11. SophosLabs. (2020, May 21). Ragnar Locker ransomware deploys virtual machine to dodge security. Retrieved June 29, 2020.
  12. Intel 471 Malware Intelligence team. (2020, March 31). REvil Ransomware-as-a-Service – An analysis of a ransomware affiliate operation. Retrieved August 4, 2020.
  13. Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.
  14. Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.
  15. Lee, S. (2019, May 17). CB TAU Threat Intelligence Notification: RobbinHood Ransomware Stops 181 Windows Services Before Encryption. Retrieved July 29, 2019.
  16. Cybereason Global SOC and Cybereason Security Research Teams. (2022, December 14). Royal Rumble: Analysis of Royal Ransomware. Retrieved March 30, 2023.
  17. Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020.
  18. DHS/CISA, Cyber National Mission Force. (2020, October 1). Malware Analysis Report (MAR) MAR-10303705-1.v1 – Remote Access Trojan: SLOTHFULMEDIA. Retrieved October 2, 2020.
  19. Berry, A., Homan, J., and Eitzman, R. (2017, May 23). WannaCry Malware Profile. Retrieved March 15, 2019.
  20. Counter Threat Unit Research Team. (2017, May 18). WCry Ransomware Analysis. Retrieved March 26, 2019.
  21. The DFIR Report. (2020, October 8). Ryuk’s Return. Retrieved October 9, 2020.
  22. Tyler Hudak. (2022, December 29). To OOB, or Not to OOB?: Why Out-of-Band Communications are Essential for Incident Response. Retrieved August 30, 2024.