Service Stop (T0881) is how an adversary in an industrial network switches off the software operators depend on to see and respond to the process: historians, OPC servers, SCADA polling, licensing and the communication services that talk to field devices. MITRE ATT&CK for ICS places it under the Inhibit Response Function tactic, and its procedure examples include ransomware kill lists (EKANS, REvil) and grid attack tools (Industroyer, Industroyer2) that stopped ICS processes before acting. This guide is for OT security engineers, SOC analysts and control system owners. It covers what T0881 looks like on OT hosts and network devices, how to detect it without alerting on every maintenance window, how to make critical services hard to stop, and how to respond safely. The enterprise view of the same behaviour is in MITRE ATT&CK T1489 Service Stop; this page covers what changes in OT.
Key takeaways
- In OT a stopped service is a loss of view or control. Stopping an OPC server, historian or front-end communication process can cut operators off from the process even when the controllers keep running.
- Ransomware does it as a side effect. EKANS and REvil terminate processes on a configured kill list so that files can be encrypted, and EKANS lists included ICS-related process names such as Proficy-named processes and licensing services.
- Targeted tools do it on purpose. ATT&CK records that Industroyer2 terminated two named processes and renamed them to prevent restart before sending IEC-104 commands.
- Who stopped it, from where and with what change ticket is the core detection question. ATT&CK's DET0765 analytics gate alerts on account, source and maintenance context.
- Prevention is mostly permissions and segmentation. Limit who can change service state, protect service binaries and registry keys, and allow management only from defined systems.
What T0881 covers in ATT&CK for ICS
ATT&CK for ICS (v20, technique version 1.1, last modified 13 October 2026) describes T0881 as stopping or disabling services on a system to render them unavailable to legitimate users, which can inhibit or stop response to an incident or support damage to the environment. It also notes that services may lock their data stores while running, so adversaries stop them to enable Data Destruction (T0809). The listed platforms are Embedded, Linux, Network Devices and Windows.
The technique sits in the ATT&CK for ICS Inhibit Response Function Tactic Guide, next to techniques that also degrade response, such as Device Restart/Shutdown (T0816) and Block Command Message. The difference is the target: T0881 acts on a software service or process, while Device Restart/Shutdown acts on the device as a whole.
| Asset | Example services at risk | Operational effect if stopped |
|---|---|---|
| SCADA or front-end server (Windows) | Protocol communication processes polling RTUs and relays | Operators lose telemetry and the ability to send commands |
| HMI host | HMI runtime, alarm services, OPC client | Loss of view and alarms at the operator station |
| Historian | Historian data collection and archive services, database engine | Gaps in process records, reporting and regulatory data |
| Licensing server | Vendor licence services | ICS applications may refuse to start or run in degraded mode |
| Linux gateways and servers | systemd units for protocol gateways, data brokers | Data flows between zones stop |
| Network devices | Routing or switching processes, management services | Communication paths between control and supervisory levels fail |
| Field devices (Embedded) | Device services restarted by protocol command | Interrupted communication or control on the device |
The examples in the left two columns are the asset classes named in the DET0765 analytics (OPC server, historian, SCADA polling, network devices, field devices) and in the procedure examples below. Your own list should come from your asset inventory; see the OT Asset Visibility Guide.
Procedure examples and what they show
ATT&CK lists five software procedure examples for T0881 and no campaigns.
| Software | What ATT&CK records | Lesson for defenders |
|---|---|---|
| EKANS (S0605) | Kills a process if its name matches the kill list before encrypting | Commodity-style ransomware can carry ICS process names |
| Industroyer (S0604) | Can stop a service itself, or log in as a user and stop a service as that user | Valid accounts make the stop look like administration |
| Industroyer2 (S1072) | Terminates PServiceControl.exe and PService_PDD.exe and renames each to prevent restart, from a hardcoded configuration | Watch for renamed or missing service binaries, not only state changes |
| KillDisk (S0607) | Terminates two non-standard processes, one of them an ICS application | Wipers stop ICS software before destroying data |
| REvil (S0496) | Terminates every process listed in the prc field of its configuration | Kill lists are configurable per victim |
EKANS in detail: FortiGuard Labs' July 2020 analysis found that both variants it studied stopped matching services through the Windows Service Control Manager. The May 2020 process list included Proficy-named processes and licensing processes alongside backup, database and security products. The June variant also used the Windows firewall to block inbound and outbound traffic during encryption, and the malware exited unless it could resolve a victim-specific internal domain, so it was built to run only inside one network.
Industroyer2 in detail: ESET's April 2022 analysis, produced with CERT-UA, describes the tool being scheduled against high-voltage substations of a Ukrainian energy provider on 8 April 2022. Before connecting to its target devices over IEC-104, it terminated a legitimate process used in daily operations and renamed its file so that it could not restart automatically. ESET attributed the attack to Sandworm with high confidence; see the Sandworm Threat Actor Profile. For the wider history see the ICS Malware History Guide.
Detection: the DET0765 analytics
ATT&CK's detection strategy for T0881 (DET0765) has four analytics, one per platform family. Each carries an OT operational fidelity gate: alert only when the action is not attributable to an authorised operator or engineering source for that target, and it falls outside an approved maintenance window or lacks change-control context.
| Analytic | Platform | Telemetry | What to look for |
|---|---|---|---|
| AN1897 | Windows | Sysmon Event ID 1; Windows System log Event ID 7036 | sc.exe or net.exe aimed at a critical ICS service from an account outside the service administration set, followed by the service entering the Stopped state with no change ticket |
| AN2140 | Linux | auditd execve records | systemctl stop or kill aimed at an ICS service process from a UID that is not the service owner or an authorised administrator |
| AN2195 | Network devices | Network device syslog | SNMP SET to a service stop OID, or a CLI command stopping a routing or switching process, from a source outside the approved network management subnet |
| AN2230 | Field devices | Network security monitoring of protocol content | ICS protocol restart commands from a source not on the engineering workstation list, especially to several devices in a short window |
Making the analytics work in a plant
- Critical service list: name the services per host role (front-end, HMI, historian, licensing, gateways). The analytics are only as good as this list.
- Authorised administrators: keep a short, named set of accounts allowed to change service state on each host role. Industroyer's ability to stop a service as a logged-in user is why shared accounts make this analytic blind.
- Change calendar: feed maintenance windows and change tickets into the SIEM so planned stops are suppressed and unplanned ones stand out.
- Binary integrity: alert when a service executable disappears or is renamed, which is the Industroyer2 pattern and does not always produce a clean service stop event.
- Process state from the operator side: loss of telemetry, stale historian tags and communication alarms are often the first signal. Route them to the SOC as well as to operations. The OT Network Security Monitoring Guide covers the network sensors behind AN2230.
Prevention: making critical services hard to stop
ATT&CK lists four mitigations for T0881.
| Mitigation | ATT&CK guidance | OT implementation |
|---|---|---|
| M0918 User Account Management | Only authorised administrators can change service states and configurations | Remove local admin from operator accounts; named engineering accounts; no shared admin passwords on HMIs |
| M0924 Restrict Registry Permissions | Proper registry permissions so adversaries cannot disable critical services | Review service configuration keys for ICS services so only administrators and SYSTEM can write |
| M0922 Restrict File and Directory Permissions | Proper process and file permissions on critical services | Lock down ICS application folders so binaries cannot be renamed or replaced by standard users |
| M0930 Network Segmentation | Restrict access to critical functions to predetermined management systems | Allow remote service management, SNMP write and protocol restart commands only from named management hosts in the right zone |
Two further controls follow from the procedure examples. Ransomware that reaches OT hosts runs its kill list, so the decisive controls are the ones that keep it out: segmenting IT and OT with a demilitarised zone, as CISA and partner agencies list among their primary mitigations for OT. And because a stop is often followed by destruction, keep tested offline backups and golden images of ICS servers; see the OT Backup, Recovery and Golden Image Guide. Host hardening for the affected systems is in the HMI and SCADA Server Hardening Guide.
Where identity fits
Service stops are an identity problem as much as a host problem. ICS applications often run under service accounts with broad rights, engineering teams share administrator logons on HMIs, and vendors keep standing remote access. Each of these lets an intruder stop services in a way that looks like normal administration. Give each service its own least-privilege account without interactive logon, retire shared admin accounts in favour of named ones, and broker vendor access with time limits. See the Service Account Security Guide and the OT Remote Access Guide.
Implementation in phases
- Inventory (weeks 1 to 4): list critical services per host role, their accounts and who may stop them. Agree the list with operations.
- Telemetry (weeks 2 to 8): collect Event ID 7036 and Sysmon process creation from Windows ICS hosts, auditd from Linux hosts, syslog from network devices, and protocol monitoring at the supervisory level. Confirm vendor support for any agent first.
- Detect in report-only mode (weeks 6 to 12): run the DET0765 logic against the change calendar and tune out planned work before paging anyone.
- Harden permissions (pilot ring first): tighten service, registry and folder permissions on one non-critical host per role, test start, stop and patching with the vendor, then roll out. Keep the previous permission set exported so a change can be reverted.
- Restrict management paths: limit remote service control, SNMP write and protocol restart traffic to named management hosts at the zone boundary.
- Exercise: rehearse a critical service stop with operations, including manual operation and restore from golden image.
Safe response
- Process safety first: confirm with operations whether the process is still under control and whether manual operation is needed before touching hosts.
- Do not simply restart: check whether the binary was renamed or replaced and whether other hosts show the same pattern, since a stop is often the step before encryption or wiping.
- Contain at the conduit: block the source host's management paths into the affected zone rather than isolating operator stations by reflex.
- Preserve evidence: System and Sysmon logs, auditd logs, network captures of the restart commands and the service binaries.
- Recover from known good: restore from verified images and controller backups, then reset the credentials used.
Metrics that show it is working
- Share of critical ICS hosts sending service state and process creation telemetry to the SOC.
- Number of accounts able to change service state per host role, trended down.
- Unplanned critical service stops per month, and the share explained by a change ticket within one working day.
- Mean time from a critical service stop to SOC triage.
- Share of ICS hosts with a tested golden image less than one year old.
Framework mapping
| Framework | Reference | Relevance to T0881 |
|---|---|---|
| ATT&CK for ICS | TA0107, T0881, DET0765, M0918, M0924, M0922, M0930 | Technique, detection and mitigations |
| ATT&CK Enterprise | T1489 Service Stop | IT equivalent for the same behaviour |
| NIST SP 800-53 Rev. 5 | AC-6, CM-7, SI-4, SC-7, CP-10 | Least privilege, least functionality, monitoring, boundary protection, recovery |
| NIST CSF 2.0 | PR.AA-05, DE.CM-09, RS.MI-01 | Access permissions, monitoring of computing hardware and software, containment |
| NIST SP 800-82 Rev. 3 | OT overlay guidance | Applying the controls above to OT systems |
Common failure patterns
- Shared administrator accounts on HMIs: every stop looks authorised, so the account gate in AN1897 never fires.
- Alerting on every stop: without the change calendar the analytic floods during outages and gets muted.
- Watching state changes only: a renamed binary, as with Industroyer2, may show up as a failed start rather than an attacker stop.
- No owner for operator-side signals: stale tags and communication alarms stay with operations and never reach the SOC.
- Flat IT to OT paths: ransomware kill lists reach ICS hosts because file sharing and remote management cross the boundary.
Practitioner checklist
- List critical ICS services per host role and agree it with operations.
- Name the accounts allowed to change service state on each role and remove the rest.
- Collect Event ID 7036, Sysmon process creation, auditd and network device syslog from OT hosts.
- Deploy the DET0765 analytics with change calendar suppression, in report-only mode first.
- Monitor service binaries for rename or replacement.
- Restrict remote service control, SNMP write and protocol restart commands to named management hosts.
- Run ICS applications under least-privilege service accounts without interactive logon.
- Keep tested golden images and offline backups for ICS servers.
- Exercise a critical service stop with operations once a year.
Standards and references
- MITRE ATT&CK for ICS: Service Stop (T0881)
- MITRE ATT&CK Enterprise: Service Stop (T1489)
- NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
- CISA, FBI, EPA and DOE: Primary Mitigations to Reduce Cyber Threats to Operational Technology
- ESET: Industroyer2, Industroyer reloaded
- FortiGuard Labs: EKANS Ransomware, a Malware Targeting OT ICS Systems
Related NHI Mgmt Group resources: MITRE ATT&CK for ICS Guide · ATT&CK for ICS Inhibit Response Function Tactic Guide · OT Security Guide · OT Security Operations Centre Guide