Analytics BIOC Informational
✕

A service was disabled

A service was disabled abnormally. This may be performed by malicious actors in an attempt to evade detection or limit functionality.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Impact (TA0040)
ATT&CK techniques: Service Stop (T1489)
Attacker's goals:

Evade detection by certain programs. Limit the functionality and availability of systems, services, and network resources.

Investigative actions:

Check if the disabled service could potentially threaten a malicious actor, or if holds a critical role. Investigate the disabling process to understand if it performed other suspicious actions.

Test period:
N/A (single event)
Deduplication:
1 Day
3 variations:
  • A service was disabled without using the ServiceControlManager RPC interface Informational
  • An injected process performed an uncommon service deactivation Informational
  • An unsigned process performed an uncommon service deactivation Low (parent: Informational)