T1668No distinct observable

Exclusive Control

PersistenceLinux, macOS, Windows

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

Exclusive control is defined by intent and context, and every command the brief names is already the observable of a different technique, with the distinguishing context sitting entirely in knobs lib/sigma cannot express. AN0045's Windows process_creation leg lists 'service stop commands, suspicious process termination, and execution of binaries or scripts aligned with known patching or service management tools'. The service-stop half is the published T1489 rule in this corpus (sc.exe/net.exe/Stop-Service with a stop verb or start= disabled), and for defensive services it is T1562.001; nothing in AN0045 separates a stop meant to deny a rival actor from an ordinary stop, because the separation lives in MITRE's TimeWindow knob (correlate the command with a termination 5-15 minutes later) and in the phrase 'outside of expected admin contexts', i.e. […]

Covered instead by T1489, T1687, T1685 (was T1562.001).

What the technique is

Adversaries who successfully compromise a system may attempt to maintain persistence by “closing the door” behind them – in other words, by preventing other threat actors from initially accessing or maintaining a foothold on the same system. For example, adversaries may patch a vulnerable, compromised system to prevent other threat actors from leveraging that vulnerability in the future. They may “close the door” in other ways, such as disabling vulnerable services, stripping privileges from accounts, or removing other malware already on the compromised device. Hindering other threat actors may allow an adversary to maintain sole access to a compromised system or network. This prevents the threat actor from needing to compete with or even being removed themselves by other threat actors. It also reduces the “noise” in the environment, lowering the possibility of being caught and evicted by defenders. Finally, in the case of Resource Hijacking, leveraging a compromised device’s full power allows the threat actor to maximize profit.

Read it on attack.mitre.org

What MITRE says you would watch

AN0045
Detects unusual command executions and service modifications that indicate self-patching or disabling of vulnerable services post-compromise. Defenders should monitor for service stop commands, suspicious process termination, and execution of binaries or scripts aligned with known patching or service management tools outside of expected admin contexts.
AN0046
Detects adversary attempts to monopolize control of compromised systems by issuing service stop commands, unloading vulnerable modules, or forcefully killing competing processes. Defenders should monitor audit logs and syslog for administrative utilities (systemctl, service, kill) being invoked outside of normal change management.
AN0047
Detects unauthorized termination of system daemons or commands issued through launchctl or kill to stop competing services or malware processes. Defenders should monitor unified logs and EDR telemetry for unusual service modifications or terminations.