T1489: Service Stop (Forcefully stopping AV services)
Operational Executive Summary
T1489 (Service Stop (Forcefully stopping AV services)) is classified under the Impact tactic within the MITRE ATT&CK framework. Techniques adversaries use to disrupt business operations, destroy system integrity, or manipulate critical availability, including high-speed ransomware encryption and disk wiping. In telemetry gathered across enterprise endpoints and the EMBER 2018 benchmark, this technique was weaponized across 39 distinct malware families, totaling over 3,933 validated samples.
Technical Anatomy & Adversary Tradecraft
Adversaries leverage Service Stop (Forcefully stopping AV services) to accomplish operational objectives while minimizing anomalous forensic footprints. When executing Service Stop (Forcefully stopping AV services), malicious binaries commonly interact directly with low-level Windows APIs, kernel mode drivers, or native scripting interfaces to bypass traditional file-integrity monitors and static antivirus signatures.
In modern multi-stage campaigns, T1489 is frequently observed functioning as an intermediate bridge: initial access payloads (such as spearphishing loaders or exploit macros) execute Service Stop (Forcefully stopping AV services) to establish in-memory execution or persistence before staging secondary ransomware or data-exfiltration implants.
Authoritative MITRE ATT&CK Reference: View official technique documentation, sub-techniques, and adversary groups at
https://attack.mitre.org/techniques/T1489/.
Detection Engineering & Threat Hunting
Detecting Service Stop (Forcefully stopping AV services) requires telemetry correlation across endpoint detection and response (EDR) agents, Sysmon event streams, and security information event management (SIEM) pipelines:
- Process Creation & Lineage: Monitor parent-child process anomalies where unexpected parent binaries (e.g., Office executables, web browsers, or script hosts) spawn command shells or native Windows utilities.
- API Hooking & Behavioral Telemetry: EDR platforms should flag rapid calls to memory allocation, process injection, or registry manipulation APIs originating from unbacked executable memory regions.
- Network Anomaly Correlation: Cross-reference endpoint execution timestamps with external network socket establishment to identify anomalous beaconing or covert data staging.
SOC Containment & Hardening Guidance
To mitigate risks associated with T1489 (Service Stop (Forcefully stopping AV services)) across production infrastructure, security teams should implement the following defensive controls:
- Attack Surface Reduction (ASR): Enforce strict application control policies (WDAC or AppLocker) to restrict execution to signed and verified corporate binaries.
- Least Privilege & Credential Hygiene: Restrict local administrative privileges to prevent adversaries from tampering with defensive agents or escalating privileges.
- Network Microsegmentation: Restrict lateral communication across endpoint VLANs to prevent wormable payloads from utilizing Service Stop (Forcefully stopping AV services) across adjacent network segments.
Cataloged Malware Families Utilizing T1489 (39 Families)
The following malware families in the SystemHelpDesk catalog have been verified utilizing T1489 (Service Stop (Forcefully stopping AV services)):
39 families
| Family | Category | Sample Count | Technical Summary |
|---|---|---|---|
| gandcrab | Ransomware | 2,992 | GandCrab is a landmark ransomware family that revolutionized the modern cyber extortion industry by pioneering and popularizing the Ransomware-as-a-Service (Raa... |
| gandcrypt | Ransomware | 474 | Ransom:Win32/GandCrypt (widely cataloged across endpoint telemetry as Trojan-Ransom.Win32.GandCrypt, Ransom.GandCrab, or Win32/GandCrypt) is the Microsoft Defen... |
| killproc | Trojan | 141 | Trojan:Win32/Killproc (commonly documented across security vendor telemetry as Trojan.Win32.KillProc, Win32/Killproc, or Trojan.BAT.KILLPROC) is an aggressive d... |
| sugar | Ransomware | 80 | Sugar (tracked across cybersecurity threat intelligence feeds under aliases including Sugar Ransomware, Encoded01, and Ransom.Encoded01) is a Delphi-based Ranso... |
| vundo | Trojan | 70 | Vundo (also universally known across the cybersecurity industry as Virtumonde, Trojan:Win32/Vundo, and Trojan.Vundo) is a historic, landmark Windows trojan and ... |
| crytex | Ransomware | 52 | Crytex (cataloged across security vendors and threat intelligence databases under signatures including Ransom:Win32/Crytex, Trojan-Ransom.Win32.Crysis, and Rans... |
| winsecsrv | Trojan | 45 | WinSecSrv (Windows Security Service Trojan) is a stealthy backdoor and trojan downloader active since 2012 that deliberately masquerades as a legitimate Windows... |
| disabler | Ransomware | 10 | Trojan:Win32/Disabler (or generic **Disabler** heuristics) represents a critical class of malware specifically engineered to actively hunt, cripple, and termina... |
| antavmu | Ransomware | 9 | Antavmu (classified in antivirus detection telemetry under designations including Ransom:Win32/Antavmu, Ransom.Win32.Antavmu, and Win32/Antavmu) is a crypto-ran... |
| datakeeper | Ransomware | 7 | Ransom:Win32/Datakeeper is a destructive ransomware family that targets both individual users and enterprise networks, utilizing strong cryptographic algorithms... |
| donex | Ransomware | 7 | Ransom:Win32/Donex is a destructive ransomware family that targets both individual users and enterprise networks, utilizing strong cryptographic algorithms to e... |
| idlebuddy | Advanced Threat | 7 | PUA:Win32/Idlebuddy is a persistent Potentially Unwanted Program (PUA) that functions primarily as a stealthy **Cryptominer** and distributed computing node. It... |
| crypmodadv | Ransomware | 6 | Ransom:Win32/Crypmodadv is a generic detection for a class of highly destructive **Ransomware** and advanced Crypters. It is designed to aggressively infiltrate... |
| globeimposter | Ransomware | 4 | Ransom:Win32/Globeimposter is a highly prevalent, aggressive crypto-ransomware family that became notorious for its devastating attacks on healthcare organizati... |
| paradise | Ransomware | 4 | Ransom:Win32/Paradise is a prolific crypto-ransomware family operating under a Ransomware-as-a-Service (RaaS) model. It allows affiliates to distribute the malw... |
| mousedisable | Ransomware | 2 | Trojan:Win32/Mousedisable is a heuristic detection for a specific, highly disruptive behavioral trait found in various 'Joke' programs, Lockers, and poorly writ... |
| ranpax | Ransomware | 2 | Ransomware:Win32/Ranpax is a destructive cryptographic ransomware family. Upon execution, it systematically encrypts critical user data, business documents, dat... |
| anyprotect | Trojan | 1 | Anyprotect (classified in antivirus detection telemetry under designations including Trojan:Win32/Anyprotect, Trojan.Win32.Anyprotect, and Win32/Anyprotect) is ... |
| delfile | Ransomware | 1 | <h3>Executive Summary</h3> Delfile (short for "Delete File") is a generic classification for a destructive Trojan whose primary function is the systematic delet... |
| diskscanfa | Advanced Threat | 1 | <h3>Executive Summary</h3> DiskScanFA is a classification for a specific family of Rogue Security Software, commonly referred to as "FakeAV" or "Scareware." It ... |
| dlsecure | Ransomware | 1 | <h3>Executive Summary</h3> Dlsecure is a prominent example of "Rogue AV" or "Scareware." It is a deceptive, malicious application designed to aggressively mimic... |
| fakehack | Advanced Threat | 1 | Program:Win32/Fakehack (or similar Rogue Security Software) is a type of Scareware or Potentially Unwanted Program (PUP) that uses social engineering to extort ... |
| fraud | Trojan | 1 | <h3>Executive Summary</h3> Fraud (often categorized as Trojan.Fraud, Rogue.Fraud, or FakeAV) is a generic classification for a highly aggressive form of Scarewa... |
| idlecrawler | Advanced Threat | 1 | Adware/Bot:Win32/Idlecrawler is a sneaky class of malware designed to exploit system resources or display advertisements exclusively when the user is not active... |
| keyboarddisable | Ransomware | 1 | <h3>Executive Summary</h3> "KeyboardDisable" is not a fully-featured malware family, but rather a specific, malicious payload component or behavioral symptom of... |
| killall | Ransomware | 1 | <h3>Executive Summary</h3> KillAll is a classification for malicious scripts, utilities, or "HackTools" specifically designed to aggressively terminate running ... |
| killapp | Ransomware | 1 | <h3>Executive Summary</h3> KillApp (often detected as Riskware.KillApp, Tool.KillApp, or Trojan.KillApp) identifies a specific class of malicious utilities or s... |
| orangedefender | Ransomware | 1 | <h3>Executive Summary</h3> OrangeDefender is a prominent example of Rogue Security Software (also known as FakeAV or Scareware). It is a highly deceptive progra... |
| payer | Ransomware | 1 | Ransom:Win32/Payer is a generic categorization applied to trojans that exhibit the unmistakable behavioral patterns of Ransomware or digital extortion (`T1486`)... |
| recory | Ransomware | 1 | <h3>Executive Summary</h3> Recory is a deceptive malware family that operates primarily as "Scareware" or a Fake Antivirus (Fake AV) program, while occasionally... |
| satancrypt | Ransomware | 1 | <h3>Executive Summary</h3> Satancrypt (often related to the "Satan" Ransomware-as-a-Service family) is a highly destructive strain of enterprise ransomware desi... |
| screen | Ransomware | 1 | <h3>Executive Summary</h3> "Screen" (often categorized as ScreenLocker or Winlock) refers to a specific subclass of Ransomware that primarily aims to extort vic... |
| shutdown | Ransomware | 1 | <h3>Executive Summary</h3> "Shutdown" (often detected as Riskware.Shutdown or Joke.Shutdown) is a classification for simple, usually non-destructive utility pro... |
| sign0fmisery | Trojan | 1 | <h3>Executive Summary</h3> Sign0fmisery is a classification typically assigned to a specific HackTool or highly destructive Trojan framework. It is designed to ... |
| spypro | Trojan | 1 | <h3>Executive Summary</h3> SpyPro (often associated with the SpySheriff or SpywareProtect2009 families) is a highly aggressive form of Rogue Antivirus (Scarewar... |
| taskkill | Ransomware | 1 | <h3>Executive Summary</h3> The detection of "Taskkill" in a security context refers to the malicious abuse of the legitimate, built-in Windows utility `taskkill... |
| w10tweak | Ransomware | 1 | <h3>Executive Summary</h3> W10Tweak (often flagged as HackTool.Win32.W10Tweak or Riskware.Win10Tweaker) is a classification for various third-party utilities de... |
| wlock | Ransomware | 1 | <h3>Executive Summary</h3> Wlock is a destructive Ransomware variant (often functioning as a "Screen Locker"). Its primary objective is to extort money from the... |
| blasterx | Worm | Sampled | BlasterX is a variant of the notorious Blaster worm that caused widespread disruption on the internet in the early 2000s. Operating as a network worm, BlasterX ... |