Detect Disable or Modify Tools in Splunk
Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying/deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems. Additionally, adversaries may exploit legitimate drivers from anti-virus software to gain kernel access (BYOVD), abuse the Windows TTD monitor driver to debug and suspend EDR processes, or unhook userland DLLs to bypass security tool instrumentation.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1562 Impair Defenses
- Sub-technique
- T1562.001 Disable or Modify Tools
- Canonical reference
- https://attack.mitre.org/techniques/T1562/001/
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval CommandLine=lower(CommandLine)
| eval ServiceKill=if(match(CommandLine, "(sc\s+(stop|delete|config)|net\s+stop|net1\s+stop).*(windefend|sense|msmpsvc|wdnissvc|securityhealth|crowdstrike|csfalcon|cylance|cbdefense|sentinelagent|taniumclient)"), 1, 0)
| eval ProcessKill=if(match(CommandLine, "taskkill.*(msmpeng|mssense|csfalcon|cylancesvc|cbdefense|sentinelagent|taniumclient|securityhealth)"), 1, 0)
| eval DefenderModify=if(match(CommandLine, "(set-mppreference|add-mppreference).*(disable|exclusion)"), 1, 0)
| eval AntiSpyware=if(match(CommandLine, "disableantispyware.*1"), 1, 0)
| eval SuspicionScore=ServiceKill + ProcessKill + DefenderModify + AntiSpyware
| where SuspicionScore > 0
| eval TargetTool=case(
match(CommandLine, "(windefend|msmpeng|mssense|sense|defender)"), "Windows Defender/MDE",
match(CommandLine, "(crowdstrike|csfalcon)"), "CrowdStrike Falcon",
match(CommandLine, "cylance"), "Cylance",
match(CommandLine, "(carbon|cbdefense)"), "Carbon Black",
match(CommandLine, "sentinel"), "SentinelOne",
match(CommandLine, "tanium"), "Tanium",
true(), "Other/Unknown")
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, TargetTool, ServiceKill, ProcessKill, DefenderModify, AntiSpyware, SuspicionScore
| sort - _timeDetects security tool tampering using Sysmon process creation events. Identifies service stopping/deletion, process killing, Defender preference modifications, and anti-spyware registry disablement. Assigns a suspicion score and identifies the targeted security product.
Data Sources
Required Sourcetypes
False Positives & Tuning
- IT administrators performing planned security tool maintenance, upgrades, or migrations with corresponding change tickets
- Endpoint management tools (SCCM, Intune) deploying Defender exclusion policies for legitimate applications
- Security tool uninstallation during agent version upgrades or vendor transitions
- Automated remediation scripts that restart security services after patching
Other platforms for T1562.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Stop Windows Defender via sc.exe
Expected signal: Sysmon Event ID 1: sc.exe with CommandLine containing 'stop WinDefend'. System Event ID 7036: WinDefend service entered stopped state. System Event ID 7040: WinDefend start type changed to disabled.
- Test 2Add Defender Exclusion for C: Drive
Expected signal: Sysmon Event ID 1: powershell.exe with CommandLine containing 'Add-MpPreference -ExclusionPath'. Sysmon Event ID 13: Registry value set under HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths. PowerShell ScriptBlock Log Event ID 4104. Defender Event ID 5007 (config changed).
- Test 3Kill Security Process with taskkill
Expected signal: Sysmon Event ID 1: taskkill.exe with CommandLine containing '/f /im MsMpEng.exe'. The kill will likely fail due to tamper protection, but the process creation event fires regardless.
- Test 4Disable Defender Real-Time Protection via Registry
Expected signal: Sysmon Event ID 1: reg.exe with CommandLine containing DisableRealtimeMonitoring. Sysmon Event ID 13: Registry value set. Defender Event ID 5001: Real-time protection disabled.
References (7)
- https://attack.mitre.org/techniques/T1562/001/
- https://www.sentinelone.com/labs/fin7-reboot-cybercrime-gang-enhances-ops-with-new-edr-bypasses-and-automated-attacks/
- https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md
- https://cdn.logic-control.com/docs/scadafence/Anatomy-Of-A-Targeted-Ransomware-Attack-WP.pdf
- https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/demystifying-ransomware-attacks-against-microsoft-defender/ba-p/1928947
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
Unlock Pro Content
Get the full detection package for T1562.001 including response playbook, investigation guide, and atomic red team tests.