Detect Disable or Modify Tools in Sumo Logic CSE
Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying/deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems. Additionally, adversaries may exploit legitimate drivers from anti-virus software to gain kernel access (BYOVD), abuse the Windows TTD monitor driver to debug and suspend EDR processes, or unhook userland DLLs to bypass security tool instrumentation.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1562 Impair Defenses
- Sub-technique
- T1562.001 Disable or Modify Tools
- Canonical reference
- https://attack.mitre.org/techniques/T1562/001/
Sumo Detection Query
_sourceCategory=windows/sysmon OR _sourceCategory=windows/security
| parse "EventID=*" as event_id nodrop
| parse "CommandLine=*" as command_line nodrop
| parse "Image=*" as image nodrop
| parse "ParentImage=*" as parent_image nodrop
| parse "User=*" as user nodrop
| parse "Computer=*" as host nodrop
| where event_id in ("1", "4688")
| where (
/* Service stop/delete/config against security services */
(toLowerCase(image) matches "*sc.exe*" OR toLowerCase(image) matches "*net.exe*" OR toLowerCase(image) matches "*net1.exe*")
AND (
toLowerCase(command_line) matches "*(stop|delete|config)*"
AND (toLowerCase(command_line) matches "*windefend*" OR toLowerCase(command_line) matches "*sense*"
OR toLowerCase(command_line) matches "*msmpsvc*" OR toLowerCase(command_line) matches "*wdnissvc*"
OR toLowerCase(command_line) matches "*securityhealth*" OR toLowerCase(command_line) matches "*crowdstrike*"
OR toLowerCase(command_line) matches "*csfalcon*" OR toLowerCase(command_line) matches "*cylance*"
OR toLowerCase(command_line) matches "*cbdefense*" OR toLowerCase(command_line) matches "*sentinelagent*"
OR toLowerCase(command_line) matches "*taniumclient*")
)
) OR (
/* Taskkill targeting security processes */
toLowerCase(image) matches "*taskkill.exe*"
AND (
toLowerCase(command_line) matches "*msmpeng*" OR toLowerCase(command_line) matches "*mssense*"
OR toLowerCase(command_line) matches "*csfalcon*" OR toLowerCase(command_line) matches "*cylancesvc*"
OR toLowerCase(command_line) matches "*cbdefense*" OR toLowerCase(command_line) matches "*sentinelagent*"
OR toLowerCase(command_line) matches "*taniumclient*" OR toLowerCase(command_line) matches "*securityhealth*"
)
) OR (
/* PowerShell Defender modifications */
(toLowerCase(image) matches "*powershell.exe*" OR toLowerCase(image) matches "*pwsh.exe*")
AND (toLowerCase(command_line) matches "*set-mppreference*" OR toLowerCase(command_line) matches "*add-mppreference*")
AND (toLowerCase(command_line) matches "*disable*" OR toLowerCase(command_line) matches "*exclusion*")
) OR (
toLowerCase(command_line) matches "*disableantispyware*1*"
)
| eval target_tool = if(toLowerCase(command_line) matches "*(windefend|msmpeng|mssense|sense|defender)*", "Windows Defender/MDE",
if(toLowerCase(command_line) matches "*(crowdstrike|csfalcon)*", "CrowdStrike Falcon",
if(toLowerCase(command_line) matches "*cylance*", "Cylance",
if(toLowerCase(command_line) matches "*(carbon|cbdefense)*", "Carbon Black",
if(toLowerCase(command_line) matches "*sentinel*", "SentinelOne",
if(toLowerCase(command_line) matches "*tanium*", "Tanium", "Other/Unknown"))))))
| eval action_type = if(toLowerCase(command_line) matches "*taskkill*", "Process Kill",
if(toLowerCase(command_line) matches "*(sc stop|net stop)*", "Service Stop",
if(toLowerCase(command_line) matches "*sc delete*", "Service Delete",
if(toLowerCase(command_line) matches "*sc config*", "Service Reconfigure",
if(toLowerCase(command_line) matches "*mppreference*", "Defender Policy Change",
if(toLowerCase(command_line) matches "*exclusion*", "Exclusion Added", "Other"))))))
| fields _messageTime, host, user, image, command_line, parent_image, target_tool, action_type
| sort by _messageTime descDetects security tool tampering via Sumo Logic by parsing Sysmon and Windows Security process creation events for service control operations, forced process termination, and PowerShell-based Defender policy changes targeting known AV/EDR products (T1562.001).
Data Sources
Required Tables
False Positives & Tuning
- Security product migration projects where one AV/EDR vendor is being replaced with another, requiring legitimate service stop and uninstall operations
- Automated patch management platforms that temporarily disable real-time scanning before applying OS patches to reduce false positives
- Incident response tooling that adjusts Defender exclusions to allow forensic collection agents to run without interference
Other platforms for T1562.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Stop Windows Defender via sc.exe
Expected signal: Sysmon Event ID 1: sc.exe with CommandLine containing 'stop WinDefend'. System Event ID 7036: WinDefend service entered stopped state. System Event ID 7040: WinDefend start type changed to disabled.
- Test 2Add Defender Exclusion for C: Drive
Expected signal: Sysmon Event ID 1: powershell.exe with CommandLine containing 'Add-MpPreference -ExclusionPath'. Sysmon Event ID 13: Registry value set under HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths. PowerShell ScriptBlock Log Event ID 4104. Defender Event ID 5007 (config changed).
- Test 3Kill Security Process with taskkill
Expected signal: Sysmon Event ID 1: taskkill.exe with CommandLine containing '/f /im MsMpEng.exe'. The kill will likely fail due to tamper protection, but the process creation event fires regardless.
- Test 4Disable Defender Real-Time Protection via Registry
Expected signal: Sysmon Event ID 1: reg.exe with CommandLine containing DisableRealtimeMonitoring. Sysmon Event ID 13: Registry value set. Defender Event ID 5001: Real-time protection disabled.
References (7)
- https://attack.mitre.org/techniques/T1562/001/
- https://www.sentinelone.com/labs/fin7-reboot-cybercrime-gang-enhances-ops-with-new-edr-bypasses-and-automated-attacks/
- https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md
- https://cdn.logic-control.com/docs/scadafence/Anatomy-Of-A-Targeted-Ransomware-Attack-WP.pdf
- https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/demystifying-ransomware-attacks-against-microsoft-defender/ba-p/1928947
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
Unlock Pro Content
Get the full detection package for T1562.001 including response playbook, investigation guide, and atomic red team tests.