Detect Impair Defenses in Microsoft Sentinel
Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. This may span both native defenses as well as supplemental capabilities installed by users and administrators. Adversaries may also impair routine operations that contribute to defensive hygiene, such as blocking users from logging out, preventing a system from shutting down, or disabling or modifying the update process.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1562 Impair Defenses
- Canonical reference
- https://attack.mitre.org/techniques/T1562/
KQL Detection Query
let SecurityServiceNames = dynamic(["WinDefend", "MsMpSvc", "Sense", "WdNisSvc", "WdNisDrv", "WdFilter", "WdBoot", "SecurityHealthService", "wscsvc", "EventLog", "MpsSvc"]);
let SuspiciousCommands = dynamic(["sc stop", "sc config", "net stop", "taskkill", "Set-MpPreference", "DisableRealtimeMonitoring", "DisableBehaviorMonitoring", "Remove-MpPreference", "auditpol /clear", "auditpol /set", "wevtutil cl", "bcdedit /set", "netsh advfirewall set"]);
union DeviceProcessEvents, DeviceRegistryEvents
| where Timestamp > ago(24h)
| extend CommandLine = coalesce(ProcessCommandLine, "")
| where CommandLine has_any (SuspiciousCommands)
or (ActionType == "RegistryValueSet" and RegistryKey has_any ("WinDefend", "EventLog", "SecurityHealth", "MpsSvc"))
| extend StoppedService = extract(@"(?:sc\s+(?:stop|config)|net\s+stop)\s+([\w]+)", 1, CommandLine)
| extend IsSecurityService = StoppedService in (SecurityServiceNames)
| project Timestamp, DeviceName, AccountName, ActionType, CommandLine, RegistryKey, RegistryValueName, RegistryValueData, StoppedService, IsSecurityService
| sort by Timestamp descBroad detection for defense impairment activities across Windows endpoints. Monitors for security service stopping, firewall modifications, event log clearing, audit policy changes, safe mode boot changes, and Defender preference modifications. Combines process creation and registry events for comprehensive coverage.
Data Sources
Required Tables
False Positives & Tuning
- IT administrators performing legitimate maintenance or reconfiguration of security tools during planned change windows
- Endpoint management tools (SCCM, Intune, GPO) updating Defender exclusions or policies
- Security tool upgrades that temporarily stop and restart services
Other platforms for T1562
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Stop Windows Defender Service
Expected signal: Sysmon Event ID 1: Process Create with CommandLine 'sc stop WinDefend'. System Event ID 7036: Windows Defender Antivirus Service entered the stopped state. Security Event ID 4688 if command line auditing enabled.
- Test 2Clear Security Event Log
Expected signal: Security Event ID 1102: The audit log was cleared. Sysmon Event ID 1: Process Create with CommandLine 'wevtutil cl Security'.
- Test 3Disable Audit Policy
Expected signal: Security Event ID 4719: System audit policy was changed. Sysmon Event ID 1: Process Create with CommandLine 'auditpol /clear /y'.
References (5)
- https://attack.mitre.org/techniques/T1562/
- https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations
- https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562/T1562.md
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
Unlock Pro Content
Get the full detection package for T1562 including response playbook, investigation guide, and atomic red team tests.
Related Detections
Sub-techniques (12)
- T1562.001Disable or Modify Tools
- T1562.002Disable Windows Event Logging
- T1562.003Impair Command History Logging
- T1562.004Disable or Modify System Firewall
- T1562.006Indicator Blocking
- T1562.007Disable or Modify Cloud Firewall
- T1562.008Disable or Modify Cloud Logs
- T1562.009Safe Mode Boot
- T1562.010Downgrade Attack
- T1562.011Spoof Security Alerting
- T1562.012Disable or Modify Linux Audit System
- T1562.013Disable or Modify Network Device Firewall