A service was disabled

Cortex XDR Analytics Alert Reference by data source

Product

Cortex XDR

Last date published

2024-12-03

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent
Detection Modules
Detector Tags
ATT&CK Tactic	Impact (TA0040)
ATT&CK Technique	Service Stop (T1489)
Severity	Informational

Description

A service was disabled abnormally. This may be performed by malicious actors in an attempt to evade detection or limit functionality.

Attacker's Goals

Evade detection by certain programs.
Limit the functionality and availability of systems, services, and network resources.

Investigative actions

Check if the disabled service could potentially threaten a malicious actor, or if holds a critical role.
Investigate the disabling process to understand if it performed other suspicious actions.

Variations

A service was disabled without using the ServiceControlManager RPC interface

Synopsis

ATT&CK Tactic	Impact (TA0040)
ATT&CK Technique	Service Stop (T1489)
Severity	Informational

Description

A service was disabled abnormally through the registry. This may be performed by malicious actors in an attempt to evade detection or limit functionality.

Attacker's Goals

Evade detection by certain programs.
Limit the functionality and availability of systems, services, and network resources.

Investigative actions

Check if the disabled service could potentially threaten a malicious actor, or if holds a critical role.
Investigate the disabling process to understand if it performed other suspicious actions.

An injected process performed an uncommon service deactivation

Synopsis

ATT&CK Tactic	Impact (TA0040)
ATT&CK Technique	Service Stop (T1489)
Severity	Informational

Description

A service was disabled abnormally. This may be performed by malicious actors in an attempt to evade detection or limit functionality.

Attacker's Goals

Evade detection by certain programs.
Limit the functionality and availability of systems, services, and network resources.

Investigative actions

Check if the disabled service could potentially threaten a malicious actor, or if holds a critical role.
Investigate the disabling process to understand if it performed other suspicious actions.

An unsigned process performed an uncommon service deactivation

Synopsis

ATT&CK Tactic	Impact (TA0040)
ATT&CK Technique	Service Stop (T1489)
Severity	Low

Description

A service was disabled abnormally. This may be performed by malicious actors in an attempt to evade detection or limit functionality.

Attacker's Goals

Evade detection by certain programs.
Limit the functionality and availability of systems, services, and network resources.

Investigative actions

Check if the disabled service could potentially threaten a malicious actor, or if holds a critical role.
Investigate the disabling process to understand if it performed other suspicious actions.