MITRE ATT&CK Technique
Description
Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster) Adversaries may accomplish this by disabling individual services of high importance to an organization, such as <code>MSExchangeIS</code>, which will make Exchange content inaccessible.(Citation: Novetta Blockbuster) In some cases, adversaries may stop or disable many or all services to render systems unusable.(Citation: Talos Olympic Destroyer 2018) Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct [Data Destruction](https://attack.mitre.org/techniques/T1485) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) on the data stores of services like Exchange and SQL Server, or on virtual machines hosted on ESXi infrastructure.(Citation: SecureWorks WannaCry Analysis)(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021) Threat actors may also disable or stop service in cloud environments. For example, by leveraging the `DisableAPIServiceAccess` API in AWS, a threat actor may prevent the service from creating service-linked roles on new accounts in the AWS Organization.(Citation: Datadog Security Labs Cloud Persistence 2025)(Citation: AWS DisableAWSServiceAccess)
Supported Platforms
Created
April 29, 2026
Last Updated
April 29, 2026
STIX Data
{'created': '2019-03-29T19:00:55.901Z',
'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
'description': 'Adversaries may stop or disable services on a system to '
'render those services unavailable to legitimate users. '
'Stopping critical services or processes can inhibit or stop '
"response to an incident or aid in the adversary's overall "
'objectives to cause damage to the environment.(Citation: '
'Talos Olympic Destroyer 2018)(Citation: Novetta '
'Blockbuster) \n'
'\n'
'Adversaries may accomplish this by disabling individual '
'services of high importance to an organization, such as '
'<code>MSExchangeIS</code>, which will make Exchange content '
'inaccessible.(Citation: Novetta Blockbuster) In some cases, '
'adversaries may stop or disable many or all services to '
'render systems unusable.(Citation: Talos Olympic Destroyer '
'2018) Services or processes may not allow for modification of '
'their data stores while running. Adversaries may stop '
'services or processes in order to conduct [Data '
'Destruction](https://attack.mitre.org/techniques/T1485) or '
'[Data Encrypted for '
'Impact](https://attack.mitre.org/techniques/T1486) on the '
'data stores of services like Exchange and SQL Server, or on '
'virtual machines hosted on ESXi infrastructure.(Citation: '
'SecureWorks WannaCry Analysis)(Citation: Crowdstrike '
'Hypervisor Jackpotting Pt 2 2021)\n'
'\n'
'Threat actors may also disable or stop service in cloud '
'environments. For example, by leveraging the '
'`DisableAPIServiceAccess` API in AWS, a threat actor may '
'prevent the service from creating service-linked roles on new '
'accounts in the AWS Organization.(Citation: Datadog Security '
'Labs Cloud Persistence 2025)(Citation: AWS '
'DisableAWSServiceAccess)',
'external_references': [{'external_id': 'T1489',
'source_name': 'mitre-attack',
'url': 'https://attack.mitre.org/techniques/T1489'},
{'description': 'AWS. (n.d.). '
'DisableAWSServiceAccess. Retrieved '
'May 22, 2025.',
'source_name': 'AWS DisableAWSServiceAccess',
'url': 'https://docs.aws.amazon.com/organizations/latest/APIReference/API_DisableAWSServiceAccess.html'},
{'description': 'Counter Threat Unit Research Team. '
'(2017, May 18). WCry Ransomware '
'Analysis. Retrieved March 26, 2019.',
'source_name': 'SecureWorks WannaCry Analysis',
'url': 'https://www.secureworks.com/research/wcry-ransomware-analysis'},
{'description': 'Martin McCloskey. (2025, May 13). '
'Tales from the cloud trenches: The '
'Attacker doth persist too much, '
'methinks. Retrieved May 22, 2025.',
'source_name': 'Datadog Security Labs Cloud '
'Persistence 2025',
'url': 'https://securitylabs.datadoghq.com/articles/tales-from-the-cloud-trenches-the-attacker-doth-persist-too-much/'},
{'description': 'Mercer, W. and Rascagneres, P. '
'(2018, February 12). Olympic '
'Destroyer Takes Aim At Winter '
'Olympics. Retrieved March 14, 2019.',
'source_name': 'Talos Olympic Destroyer 2018',
'url': 'https://blog.talosintelligence.com/2018/02/olympic-destroyer.html'},
{'description': 'Michael Dawson. (2021, August 30). '
'Hypervisor Jackpotting, Part 2: '
'eCrime Actors Increase Targeting of '
'ESXi Servers with Ransomware. '
'Retrieved March 26, 2025.',
'source_name': 'Crowdstrike Hypervisor Jackpotting '
'Pt 2 2021',
'url': 'https://www.crowdstrike.com/en-us/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/'},
{'description': 'Novetta Threat Research Group. '
'(2016, February 24). Operation '
'Blockbuster: Unraveling the Long '
'Thread of the Sony Attack. Retrieved '
'February 25, 2016.',
'source_name': 'Novetta Blockbuster',
'url': 'https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf'}],
'id': 'attack-pattern--20fb2507-d71c-455d-9b6d-6104461cf26b',
'kill_chain_phases': [{'kill_chain_name': 'mitre-attack',
'phase_name': 'impact'}],
'modified': '2025-10-24T17:48:30.688Z',
'name': 'Service Stop',
'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
'revoked': False,
'spec_version': '2.1',
'type': 'attack-pattern',
'x_mitre_attack_spec_version': '3.3.0',
'x_mitre_contributors': ['Liran Ravich, CardinalOps'],
'x_mitre_deprecated': False,
'x_mitre_detection': '',
'x_mitre_domains': ['enterprise-attack'],
'x_mitre_impact_type': ['Availability'],
'x_mitre_is_subtechnique': False,
'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
'x_mitre_platforms': ['ESXi', 'IaaS', 'Linux', 'macOS', 'Windows'],
'x_mitre_version': '1.4'}