Detect Impair Defenses in IBM QRadar
Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. This may span both native defenses as well as supplemental capabilities installed by users and administrators. Adversaries may also impair routine operations that contribute to defensive hygiene, such as blocking users from logging out, preventing a system from shutting down, or disabling or modifying the update process.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1562 Impair Defenses
- Canonical reference
- https://attack.mitre.org/techniques/T1562/
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
sourceip,
destinationip,
username,
QIDNAME(qid) AS event_name,
CATEGORYNAME(category) AS event_category,
"CommandLine",
"Message",
LOGSOURCENAME(logsourceid) AS log_source,
qid
FROM events
WHERE
LOGSOURCETYPEID IN (12, 13, 14, 15)
AND starttime > (CURRENT_TIMESTAMP - 86400000)
AND (
(
qid IN (5002050, 5002051, 5002052)
AND (
LOWER("CommandLine") IMATCHES '(?s).*(sc\s+(stop|config)|net\s+stop|taskkill).*(windefend|sense|msmpsvc|securityhealth|eventlog|mpsvc|wdnissvc).*'
OR LOWER("CommandLine") IMATCHES '(?s).*(auditpol\s+/(clear|set)|wevtutil\s+cl).*'
OR LOWER("CommandLine") IMATCHES '(?s).*(set-mppreference|disablerealtimemonitoring|disablebehaviormonitoring|remove-mppreference).*'
OR LOWER("CommandLine") IMATCHES '(?s).*(bcdedit\s+/set.{0,30}safeboot|netsh\s+advfirewall\s+set).*'
OR LOWER("CommandLine") IMATCHES '(?s).*taskkill.{0,50}(msmpeng|nissrv|securityhealth|mpcmdrun).*'
)
)
OR
(
qid = 5002101
)
OR
(
"EventID" IN ('1102', '4719', '7036', '7040')
)
)
ORDER BY starttime DESC
LIMIT 1000Detects T1562 Impair Defenses by correlating Windows process creation events (Sysmon EID 1 / Security EID 4688) showing security service stop commands, Defender configuration changes, audit policy tampering, log clearing events, and service state change events. Covers all major sub-techniques: service tampering, log tampering, Defender modification, and boot configuration changes.
Data Sources
Required Tables
False Positives & Tuning
- Scheduled endpoint management tasks by IT ops teams that reconfigure or restart security services during maintenance windows
- Antivirus or EDR software update processes that temporarily disable protection modules before re-enabling updated versions
- SIEM or SOAR automation playbooks that query or modify audit policies as part of incident response procedures
Other platforms for T1562
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Stop Windows Defender Service
Expected signal: Sysmon Event ID 1: Process Create with CommandLine 'sc stop WinDefend'. System Event ID 7036: Windows Defender Antivirus Service entered the stopped state. Security Event ID 4688 if command line auditing enabled.
- Test 2Clear Security Event Log
Expected signal: Security Event ID 1102: The audit log was cleared. Sysmon Event ID 1: Process Create with CommandLine 'wevtutil cl Security'.
- Test 3Disable Audit Policy
Expected signal: Security Event ID 4719: System audit policy was changed. Sysmon Event ID 1: Process Create with CommandLine 'auditpol /clear /y'.
References (5)
- https://attack.mitre.org/techniques/T1562/
- https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations
- https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562/T1562.md
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
Unlock Pro Content
Get the full detection package for T1562 including response playbook, investigation guide, and atomic red team tests.
Related Detections
Sub-techniques (12)
- T1562.001Disable or Modify Tools
- T1562.002Disable Windows Event Logging
- T1562.003Impair Command History Logging
- T1562.004Disable or Modify System Firewall
- T1562.006Indicator Blocking
- T1562.007Disable or Modify Cloud Firewall
- T1562.008Disable or Modify Cloud Logs
- T1562.009Safe Mode Boot
- T1562.010Downgrade Attack
- T1562.011Spoof Security Alerting
- T1562.012Disable or Modify Linux Audit System
- T1562.013Disable or Modify Network Device Firewall