T1489 / ATT&CK

Windows Analytic 0061

Adversary disables or stops critical services (e.g., Exchange, SQL, AV, endpoint monitoring) using native utilities or API calls, often preceding destructive actions (T1485, T1486). Behavioral chain: Elevated execution context + stop-service or sc.exe or ChangeServiceConfigW + terminated or disabled service + possible follow-up file manipulation.

• WinEventLog:Sysmon EventCode=1
• WinEventLog:Security EventCode=4672
• WinEventLog:System EventCode=7036
• WinEventLog:Sysmon EventCode=4

Linux Analytic 0062

Adversary executes systemctl or service stop targeting high-value services (e.g., mysql, sshd), possibly followed by rm or shred against data stores. Behavioral chain: sudo/su usage + stop command + /var/log/messages or syslog entries + file access/delete.

• auditd:SYSCALL execve of systemctl or service stop
• auditd:SYSCALL unlink/unlinkat on service binaries or data targets
• linux:syslog service stopped messages

macOS Analytic 0063

Use of launchctl to stop services or kill critical background processes (e.g., securityd, com.apple.*), typically followed by command-line tools like rm or diskutil. Behavioral chain: Terminal or remote shell + launchctl bootout/disable + process termination + follow-on modification.

• macos:unifiedlog launchctl disable or bootout calls
• auditd:SYSCALL execve of launchctl or pkill

ESXi Analytic 0064

Attacker disables VM-related services or stops VMs forcibly to target vmdk or logs. Behavioral chain: esxcli or vim-cmd stop + audit log showing user privilege use + datastore file manipulation.

• esxi:hostd Stop VM or disable service events via vim-cmd
• esxi:hostd Log entries indicating VM powered off or forcibly terminated