safemode.space
← MITRE ATT&CK ICS
T0881

Service Stop

Description

Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment. (Citation: Enterprise ATT&CK) Services may not allow for modification of their data stores while running. Adversaries may stop services in order to conduct Data Destruction. (Citation: Enterprise ATT&CK)

Mapped SPARTA techniques

1 techniques

  • DE-0002.01Inhibit Ground System FunctionalityST0006
    addresses
    moderate

    T0881 'Service Stop' addresses adversary stopping or disabling services to render them unavailable; SPARTA DE-0002.01 'Inhibit Ground System Functionality' covers stopping GS services (telemetry processing, command sequencing, monitoring tools). Cross-tactic moderate (T0881 in inhibit-response-function vs SPARTA DE-0002.01 defense-evasion).

Cite as SafeMode Space, mitre-attack-ics T0881.

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.