T1489Impact
Service Stop
Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment. Adversaries may accomplish this by disabling individual services of high importance to an organization, such as…
CVEs6
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.1
Reports0
Detections
20 Sigma rules tagged T1489Service StopT148920 general rules
- Delete All Scheduled Taskshightest
- Delete Important Scheduled Taskhightest
- Disable Important Scheduled Taskhightest
- Important Scheduled Task Deleted or Disabledhightest
- Suspicious Windows Service Tamperinghightest
- Azure Application Deletedmediumtest
- Azure Kubernetes Network Policy Changemediumtest
- Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deletedmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Service Stop
6 CVEs, by priority. Each link shows its badge.- CVE-2023-36884Microsoft Windows Search Remote Code Execution VulnerabilityMITRE CTID mapping of the KEV entry · follow-on activity99.4%Top 0.06%78.2priority
- CVE-2019-1747Cisco IOS and IOS XE Software Short Message Service Denial of Service VulnerabilityMITRE CTID mapping of the CVE · follow-on activity2.4%Top 16%22.8priority
- CVE-2019-3728RSA BSAFE Crypto-C Micro Edition versions from 4.0.0.0 before 4.0.5.4 and from 4.1.0 before 4.1.4, RSA BSAFE Micro…MITRE CTID mapping of the CVE · primary impact2.4%Top 16%22.1priority
- CVE-2019-1711Cisco IOS XR gRPC Software Denial of Service VulnerabilityMITRE CTID mapping of the CVE · primary impact2.3%Top 17%20.4priority
- CVE-2019-1886Cisco Web Security Appliance HTTPS Certificate Denial of Service VulnerabilityMITRE CTID mapping of the CVE · primary impact1.3%Top 29%20.3priority
- CVE-2020-3134Cisco Email Security Appliance Zip Decompression Engine Denial of Service VulnerabilityMITRE CTID mapping of the CVE · primary impact1.1%Top 35%17.6priority