Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment. (Citation: Enterprise ATT&CK) Services may not allow for modification of their data stores while running. Adversaries may stop services in order to conduct Data Destruction. (Citation: Enterprise ATT&CK)
Manage the creation, modification, use, and permissions associated to user accounts.
M0924Restrict Registry PermissionsRestrict the ability to modify certain hives or keys in the Windows Registry.
M0922Restrict File and Directory PermissionsRestrict access by setting directory and file permissions that are not specific to users or privileged accounts.
MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.