T1562 Elastic Security · Elastic

Detect Impair Defenses in Elastic Security

Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. This may span both native defenses as well as supplemental capabilities installed by users and administrators. Adversaries may also impair routine operations that contribute to defensive hygiene, such as blocking users from logging out, preventing a system from shutting down, or disabling or modifying the update process.

MITRE ATT&CK

Tactic
Defense Evasion
Technique
T1562 Impair Defenses
Canonical reference
https://attack.mitre.org/techniques/T1562/

Elastic Detection Query

Elastic Security (Elastic)
eql 
any where
(
  (
    event.category == "process" and event.type == "start" and
    (
      process.command_line regex~ "(?i)(sc\s+(stop|config)|net\s+stop|taskkill).*?(WinDefend|Sense|MsMpSvc|SecurityHealth|SecurityHealthService|EventLog|MpsSvc|wscsvc|WdNisSvc)"
      or process.command_line regex~ "(?i)(auditpol\s+/(clear|set)|wevtutil\s+cl\s)"
      or process.command_line regex~ "(?i)(Set-MpPreference|DisableRealtimeMonitoring|DisableBehaviorMonitoring|Remove-MpPreference)"
      or process.command_line regex~ "(?i)(bcdedit\s+/set\s+.{0,30}safeboot|netsh\s+advfirewall\s+set)"
      or process.command_line regex~ "(?i)taskkill.{0,50}(MsMpEng|NisSrv|SecurityHealth|MpCmdRun)"
    )
  )
  or
  (
    event.category == "registry" and event.type in ("change", "creation") and
    registry.path regex~ "(?i).*?(WinDefend|EventLog|SecurityHealth|MpsSvc|MsMpSvc).*"
  )
  or
  (
    event.category == "process" and event.type == "start" and
    winlog.event_id in ("1102", "4719")
  )
)
high severity high confidence

Detects T1562 Impair Defenses activity including security service tampering via sc/net stop commands, Windows Defender modification via Set-MpPreference, audit log clearing via auditpol or wevtutil, firewall manipulation via netsh advfirewall, and boot configuration changes via bcdedit targeting safeboot modes. Covers process execution patterns and registry modifications to security service keys.

Data Sources

Windows Endpoint LogsSysmonElastic Endpoint SecurityWindows Security Event Log

Required Tables

logs-endpoint.events.process-*logs-endpoint.events.registry-*logs-windows.sysmon_operational-*winlogbeat-*

False Positives & Tuning

  • Legitimate IT administrators performing planned maintenance on endpoint security tools or Group Policy updates that modify Defender settings
  • Enterprise software deployment systems (SCCM, Ansible, Chef) that stop/restart security services during upgrades or configuration management runs
  • Security team red team exercises or authorized penetration testing activities targeting defensive controls
  • Backup and recovery tools that temporarily disable real-time monitoring to improve performance during large backup operations

Other platforms for T1562

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 Stop Windows Defender Service

    Expected signal: Sysmon Event ID 1: Process Create with CommandLine 'sc stop WinDefend'. System Event ID 7036: Windows Defender Antivirus Service entered the stopped state. Security Event ID 4688 if command line auditing enabled.

  2. Test 2 Clear Security Event Log

    Expected signal: Security Event ID 1102: The audit log was cleared. Sysmon Event ID 1: Process Create with CommandLine 'wevtutil cl Security'.

  3. Test 3 Disable Audit Policy

    Expected signal: Security Event ID 4719: System audit policy was changed. Sysmon Event ID 1: Process Create with CommandLine 'auditpol /clear /y'.

Last updated: 2026-04-21 Research depth: deep
References (4)

Response Playbook

Triage

  1. Identify which defensive component was targeted — was it AV/EDR, event logging, firewall, or audit policy?
  2. Check the user context — is this a privileged admin account with a corresponding change ticket, or an unexpected user?
  3. Determine if the impairment was successful — did the service actually stop, was the registry key changed, was the log cleared?
  4. Look for temporal correlation — did other suspicious activity occur immediately before or after the defensive impairment?
  5. Check for lateral movement indicators — was the same impairment command executed across multiple hosts?

Containment

  1. If EDR/AV was disabled: immediately isolate the endpoint via network segmentation or EDR isolation capability
  2. If event logging was cleared or disabled: preserve remaining logs from SIEM, begin forensic imaging of the endpoint
  3. If firewall was disabled: re-enable firewall rules and block any newly opened ports at the network perimeter
  4. If audit policy was modified: restore audit policy from GPO baseline and force a gpupdate
  5. If multiple hosts affected: consider domain-wide credential reset and hunting for persistence mechanisms

Evidence Collection

  1. Windows Security Event Log — Event ID 1102 (log cleared), 4719 (audit policy changed), 4688 (process creation)
  2. System Event Log — Event ID 7036 (service state change), 7040 (service start type changed), 7045 (new service installed)
  3. Sysmon Event ID 1 (process creation), Event ID 12/13 (registry modifications)
  4. PowerShell ScriptBlock Logging — Event ID 4104 for Set-MpPreference or other Defender modification commands
  5. Registry hives — HKLM\SYSTEM\CurrentControlSet\Services for service configuration changes
  6. Memory forensics — volatile data may reveal in-memory hooks or patches to security tool DLLs

Escalation Criteria

  • !Multiple defense impairment techniques observed on the same host within a short time window (kill chain progression)
  • !Defense impairment followed by data exfiltration, lateral movement, or encryption activity
  • !Impairment detected on domain controllers, critical servers, or privileged access workstations
  • !Unknown or compromised account performing the impairment
  • !Evidence of BYOVD (Bring Your Own Vulnerable Driver) used to disable security tools at kernel level

Investigation Guide

Related Techniques

T1562.001 — Disable or Modify ToolsT1562.002 — Disable Windows Event LoggingT1562.004 — Disable or Modify System FirewallT1562.006 — Indicator BlockingT1562.009 — Safe Mode BootT1070.001 — Clear Windows Event LogsT1112 — Modify RegistryT1543.003 — Windows Service

Forensic Artifacts

  • >Registry: HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName>\Start — service start type values
  • >Registry: HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-* — event log autologger configuration
  • >Registry: HKLM\SOFTWARE\Microsoft\Windows Defender — Defender configuration and exclusions
  • >File System: C:\Windows\System32\winevt\Logs\ — event log files (.evtx) for timeline analysis
  • >Event Log: Security Event ID 1102 — provides the account that cleared the log
  • >WMI: Win32_Service for current service states and start types

Tuning Guidance

This parent detection is intentionally broad. Start by correlating alerts with your change management system — legitimate maintenance should have corresponding tickets. Build an allowlist for known admin accounts and their typical maintenance patterns. Consider splitting this into sub-detections per impairment category (service stopping, log clearing, firewall modification) for more granular tuning. Exclude known endpoint management tool service accounts (SCCM, Intune agent accounts) but only by exact account name match, never by command pattern.

Hunting Queries

Hunt for accounts or processes that have attempted to stop or reconfigure security services across the environment. High counts or multiple affected devices indicate coordinated defense impairment.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has_any ("sc stop", "sc config", "net stop", "taskkill")
| where ProcessCommandLine has_any ("WinDefend", "Sense", "MsMpSvc", "SecurityHealth", "EventLog", "CrowdStrike", "Carbon", "Tanium", "Sentinel")
| summarize Count=count(), Devices=dcount(DeviceName) by AccountName, ProcessCommandLine
| sort by Count desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (CommandLine="*sc stop*" OR CommandLine="*sc config*" OR CommandLine="*net stop*" OR CommandLine="*taskkill*") (CommandLine="*WinDefend*" OR CommandLine="*Sense*" OR CommandLine="*MsMpSvc*" OR CommandLine="*SecurityHealth*" OR CommandLine="*EventLog*" OR CommandLine="*CrowdStrike*")
| stats count as Count, dc(host) as Devices by User, CommandLine
| sort - Count

Hunt for registry modifications targeting Windows Defender settings or event log autologger configuration. These modifications can silently disable security monitoring without stopping services.

Hunting — KQL
kql 
DeviceRegistryEvents
| where Timestamp > ago(7d)
| where RegistryKey has "Windows Defender" or RegistryKey has "WMI\\Autologger\\EventLog"
| where ActionType == "RegistryValueSet"
| where RegistryValueName in ("DisableRealtimeMonitoring", "DisableBehaviorMonitoring", "Start", "Enabled", "DisableAntiSpyware")
| project Timestamp, DeviceName, AccountName, RegistryKey, RegistryValueName, RegistryValueData
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=13 OR EventCode=14) (TargetObject="*Windows Defender*" OR TargetObject="*Autologger*EventLog*") (TargetObject="*DisableRealtimeMonitoring*" OR TargetObject="*DisableBehaviorMonitoring*" OR TargetObject="*DisableAntiSpyware*" OR TargetObject="*Start*" OR TargetObject="*Enabled*")
| table _time, host, User, EventCode, TargetObject, Details
| sort - _time

Atomic Red Team Tests

Test 1 Stop Windows Defender Service
windows

Attempts to stop the Windows Defender service using sc.exe. This simulates ransomware and malware that disable AV before deploying payloads. Requires elevated privileges.

Command

powershell 
sc stop WinDefend

Cleanup

powershell 
sc start WinDefend

Expected Telemetry

Sysmon Event ID 1: Process Create with CommandLine 'sc stop WinDefend'. System Event ID 7036: Windows Defender Antivirus Service entered the stopped state. Security Event ID 4688 if command line auditing enabled.

Expected Detection

Alert fires on 'sc stop' + 'WinDefend' pattern. KQL: StoppedService='WinDefend', IsSecurityService=true. SPL: action='service_tampering'.

Test 2 Clear Security Event Log
windows

Clears the Windows Security event log using wevtutil. This is a common post-exploitation technique to cover tracks. Generates Security Event ID 1102.

Command

powershell 
wevtutil cl Security

Expected Telemetry

Security Event ID 1102: The audit log was cleared. Sysmon Event ID 1: Process Create with CommandLine 'wevtutil cl Security'.

Expected Detection

Alert fires on 'wevtutil cl' pattern and Event ID 1102. SPL: action='log_cleared' or action='log_tampering'.

Test 3 Disable Audit Policy
windows

Uses auditpol to clear all audit policies, preventing Windows from logging security events. This technique was used by Magic Hound (APT35) to evade detection.

Command

powershell 
auditpol /clear /y

Cleanup

powershell 
auditpol /set /category:* /success:enable /failure:enable

Expected Telemetry

Security Event ID 4719: System audit policy was changed. Sysmon Event ID 1: Process Create with CommandLine 'auditpol /clear /y'.

Expected Detection

Alert fires on 'auditpol /clear' pattern and Event ID 4719. SPL: action='audit_policy_changed' or action='log_tampering'.

Related Detections

Tactic Hub

TA0005 Defense Evasion

Sub-techniques (12)

Related Techniques

T1562.001 Disable or Modify Tools T1562.002 Disable Windows Event Logging T1562.004 Disable or Modify System Firewall T1562.006 Indicator Blocking T1562.009 Safe Mode Boot T1070.001 Clear Windows Event Logs T1112 Modify Registry T1543.003 Windows Service

Same Tactic: Defense Evasion

Popular Detections