Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment. [1] Services may not allow for modification of their data stores while running. Adversaries may stop services in order to conduct Data Destruction. [1]
| ID | Name | Description |
|---|---|---|
| S0605 | EKANS |
Before encrypting the process, EKANS first kills the process if its name matches one of the processes defined on the kill-list. [2] [2] EKANS also utilizes netsh commands to implement firewall rules that blocks any remote communication with the device. [3] |
| S0604 | Industroyer |
Industroyer has the capability to stop a service itself, or to login as a user and stop a service as that user. [4] |
| S1072 | Industroyer2 |
Industroyer2 has the capability to terminate specified processes (i.e., PServiceControl.exe and PService_PDD.exe) and rename each process to prevent restart. These are defined through a hardcoded configuration.[5] |
| S0607 | KillDisk |
KillDisk looks for and terminates two non-standard processes, one of which is an ICS application. [6] |
| S0496 | REvil |
REvil searches for all processes listed in the prc field within its configuration file and then terminates each process. [7] |
| ID | Mitigation | Description |
|---|---|---|
| M0930 | Network Segmentation |
Segment operational network and systems to restrict access to critical system functions to predetermined management systems. [8] |
| M0922 | Restrict File and Directory Permissions |
Ensure proper process and file permissions are in place to inhibit adversaries from disabling or interfering with critical services. |
| M0924 | Restrict Registry Permissions |
Ensure proper registry permissions are in place to inhibit adversaries from disabling or interfering with critical services. |
| M0918 | User Account Management |
Limit privileges of user accounts and groups so that only authorized administrators can change service states and configurations. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0765 | Detection of Service Stop | AN1897 |
Real-time monitoring identifies a service control command targeting a critical Industrial Control System (ICS) services such as Open Platform Communications (OPC) server, historian, Supervisory Control and Data Acquisition (SCADA) polling from an account not in the authorized service administration role, without a preceding change-control ticket, immediately followed by the service transitioning to Stopped state. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures. |
| AN2140 |
Real-time monitoring identifies systemctl stop or kill commands targeting Industrial Control System (ICS) service processes on Linux assets, from a User Identifier (UID) that is not the ICS service owner or an authorized system administrator. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures. |
||
| AN2195 |
Real-time monitoring identifies Simple Network Management Protocol (SNMP) SET commands to service-stop Object Identifiers (OIDs) or Command Line Interface (CLI) commands stopping routing/switching processes critical to Industrial Control System (ICS) communication, from sources not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures. |
||
| AN2230 |
Real-time monitoring identifies an Industrial Control System (ICS) protocol restart command directed at a field device from a source not in the approved engineering workstation list, where multiple devices receive restart commands within a short window. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures. |