- Home
- Techniques
- Enterprise
- Service Stop
Service Stop
Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.[1][2]
Adversaries may accomplish this by disabling individual services of high importance to an organization, such as MSExchangeIS
, which will make Exchange content inaccessible [2]. In some cases, adversaries may stop or disable many or all services to render systems unusable.[1] Services may not allow for modification of their data stores while running. Adversaries may stop services in order to conduct Data Destruction or Data Encrypted for Impact on the data stores of services like Exchange and SQL Server.[3]
Procedure Examples
Name | Description |
---|---|
HotCroissant |
HotCroissant has the ability to stop services on the infected host.[4] |
Lazarus Group |
Lazarus Group has stopped the MSExchangeIS service to render Exchange contents inaccessible to users.[5] |
Maze |
Maze has stopped SQL services to ensure it can encrypt any database.[6] |
Netwalker |
Netwalker can terminate system processes and services, some of which relate to backup software.[7] |
Olympic Destroyer |
Olympic Destroyer uses the API call |
Ragnar Locker |
Ragnar Locker has attempted to stop services associated with business applications and databases to release the lock on files used by these applications so they may be encrypted.[8] |
REvil |
REvil has the capability to stop services and kill processes.[9][10] |
RobbinHood |
RobbinHood stops 181 Windows services on the system before beginning the encryption process.[11] |
Ryuk |
Ryuk has called |
WannaCry |
WannaCry attempts to kill processes associated with Exchange, Microsoft SQL Server, and MySQL to make it possible to encrypt their data stores.[13][3] |
Wizard Spider |
Wizard Spider has used taskkill.exe and net.exe to stop backup, catalog, cloud, and other services prior to network encryption.[14] |
Mitigations
Mitigation | Description |
---|---|
Network Segmentation |
Operate intrusion detection, analysis, and response systems on a separate network from the production environment to lessen the chances that an adversary can see and interfere with critical response functions. |
Restrict File and Directory Permissions |
Ensure proper process and file permissions are in place to inhibit adversaries from disabling or interfering with critical services. |
Restrict Registry Permissions |
Ensure proper registry permissions are in place to inhibit adversaries from disabling or interfering with critical services. |
User Account Management |
Limit privileges of user accounts and groups so that only authorized administrators can interact with service changes and service configurations. |
Detection
Monitor processes and command-line arguments to see if critical processes are terminated or stop running.
Monitor for edits for modifications to services and startup programs that correspond to services of high importance. Look for changes to services that do not correlate with known software, patch cycles, etc. Windows service information is stored in the Registry at HKLM\SYSTEM\CurrentControlSet\Services
. Systemd service unit files are stored within the /etc/systemd/system, /usr/lib/systemd/system/, and /home/.config/systemd/user/ directories, as well as associated symbolic links.
Alterations to the service binary path or the service startup type changed to disabled may be suspicious.
Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. For example, ChangeServiceConfigW
may be used by an adversary to prevent services from starting.[1]
References
- Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.
- Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.
- Counter Threat Unit Research Team. (2017, May 18). WCry Ransomware Analysis. Retrieved March 26, 2019.
- Knight, S.. (2020, April 16). VMware Carbon Black TAU Threat Analysis: The Evolution of Lazarus. Retrieved May 1, 2020.
- Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Destructive Malware Report. Retrieved March 2, 2016.
- Brandt, A., Mackenzie, P.. (2020, September 17). Maze Attackers Adopt Ragnar Locker Virtual Machine Technique. Retrieved October 9, 2020.
- Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.
- SophosLabs. (2020, May 21). Ragnar Locker ransomware deploys virtual machine to dodge security. Retrieved June 29, 2020.
- Intel 471 Malware Intelligence team. (2020, March 31). REvil Ransomware-as-a-Service – An analysis of a ransomware affiliate operation. Retrieved August 4, 2020.
- Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.
- Lee, S. (2019, May 17). CB TAU Threat Intelligence Notification: RobbinHood Ransomware Stops 181 Windows Services Before Encryption. Retrieved July 29, 2019.
- Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020.
- Berry, A., Homan, J., and Eitzman, R. (2017, May 23). WannaCry Malware Profile. Retrieved March 15, 2019.
- The DFIR Report. (2020, October 8). Ryuk’s Return. Retrieved October 9, 2020.