Detect Impair Defenses in Elastic Security
Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. This may span both native defenses as well as supplemental capabilities installed by users and administrators. Adversaries may also impair routine operations that contribute to defensive hygiene, such as blocking users from logging out, preventing a system from shutting down, or disabling or modifying the update process.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1562 Impair Defenses
- Canonical reference
- https://attack.mitre.org/techniques/T1562/
Elastic Detection Query
any where
(
(
event.category == "process" and event.type == "start" and
(
process.command_line regex~ "(?i)(sc\s+(stop|config)|net\s+stop|taskkill).*?(WinDefend|Sense|MsMpSvc|SecurityHealth|SecurityHealthService|EventLog|MpsSvc|wscsvc|WdNisSvc)"
or process.command_line regex~ "(?i)(auditpol\s+/(clear|set)|wevtutil\s+cl\s)"
or process.command_line regex~ "(?i)(Set-MpPreference|DisableRealtimeMonitoring|DisableBehaviorMonitoring|Remove-MpPreference)"
or process.command_line regex~ "(?i)(bcdedit\s+/set\s+.{0,30}safeboot|netsh\s+advfirewall\s+set)"
or process.command_line regex~ "(?i)taskkill.{0,50}(MsMpEng|NisSrv|SecurityHealth|MpCmdRun)"
)
)
or
(
event.category == "registry" and event.type in ("change", "creation") and
registry.path regex~ "(?i).*?(WinDefend|EventLog|SecurityHealth|MpsSvc|MsMpSvc).*"
)
or
(
event.category == "process" and event.type == "start" and
winlog.event_id in ("1102", "4719")
)
)Detects T1562 Impair Defenses activity including security service tampering via sc/net stop commands, Windows Defender modification via Set-MpPreference, audit log clearing via auditpol or wevtutil, firewall manipulation via netsh advfirewall, and boot configuration changes via bcdedit targeting safeboot modes. Covers process execution patterns and registry modifications to security service keys.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate IT administrators performing planned maintenance on endpoint security tools or Group Policy updates that modify Defender settings
- Enterprise software deployment systems (SCCM, Ansible, Chef) that stop/restart security services during upgrades or configuration management runs
- Security team red team exercises or authorized penetration testing activities targeting defensive controls
- Backup and recovery tools that temporarily disable real-time monitoring to improve performance during large backup operations
Other platforms for T1562
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Stop Windows Defender Service
Expected signal: Sysmon Event ID 1: Process Create with CommandLine 'sc stop WinDefend'. System Event ID 7036: Windows Defender Antivirus Service entered the stopped state. Security Event ID 4688 if command line auditing enabled.
- Test 2Clear Security Event Log
Expected signal: Security Event ID 1102: The audit log was cleared. Sysmon Event ID 1: Process Create with CommandLine 'wevtutil cl Security'.
- Test 3Disable Audit Policy
Expected signal: Security Event ID 4719: System audit policy was changed. Sysmon Event ID 1: Process Create with CommandLine 'auditpol /clear /y'.
References (5)
- https://attack.mitre.org/techniques/T1562/
- https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations
- https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562/T1562.md
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
Unlock Pro Content
Get the full detection package for T1562 including response playbook, investigation guide, and atomic red team tests.
Related Detections
Sub-techniques (12)
- T1562.001Disable or Modify Tools
- T1562.002Disable Windows Event Logging
- T1562.003Impair Command History Logging
- T1562.004Disable or Modify System Firewall
- T1562.006Indicator Blocking
- T1562.007Disable or Modify Cloud Firewall
- T1562.008Disable or Modify Cloud Logs
- T1562.009Safe Mode Boot
- T1562.010Downgrade Attack
- T1562.011Spoof Security Alerting
- T1562.012Disable or Modify Linux Audit System
- T1562.013Disable or Modify Network Device Firewall