Nightspire - Stopping Backup and Database Services (T1489)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•1•0•2

Identifies the ransomware executing taskkill or net stop to forcefully terminate SQL, Exchange, and backup services, freeing file locks for successful encryption.