T1489
Service Stop
Adversaries may stop or disable services on a system to render it unusable or to hinder detection/recovery.
ATT&CK / Impact
Defense strategies
- Service monitoring
- Restrict service control permissions
- Redundancy planning
Detection methods
- Monitor service state changes
- Track net stop commands
- Alert on critical service stops
D3FEND mappings
1