Detect Impair Defenses in Splunk
Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. This may span both native defenses as well as supplemental capabilities installed by users and administrators. Adversaries may also impair routine operations that contribute to defensive hygiene, such as blocking users from logging out, preventing a system from shutting down, or disabling or modifying the update process.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1562 Impair Defenses
- Canonical reference
- https://attack.mitre.org/techniques/T1562/
SPL Detection Query
index=wineventlog (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1) OR (sourcetype="WinEventLog:System" EventCode IN (7036, 7040, 7045)) OR (sourcetype="WinEventLog:Security" EventCode IN (1102, 4719))
| eval action=case(
EventCode==1 AND match(CommandLine, "(?i)(sc\s+(stop|config)|net\s+stop|taskkill).*(WinDefend|Sense|MsMpSvc|SecurityHealth|EventLog|MpsSvc)"), "service_tampering",
EventCode==1 AND match(CommandLine, "(?i)(auditpol\s+/(clear|set)|wevtutil\s+cl)"), "log_tampering",
EventCode==1 AND match(CommandLine, "(?i)(Set-MpPreference|DisableRealtimeMonitoring|DisableBehaviorMonitoring)"), "defender_modification",
EventCode==1 AND match(CommandLine, "(?i)(bcdedit\s+/set\s+.*safeboot|netsh\s+advfirewall)"), "boot_or_firewall",
EventCode==1102, "log_cleared",
EventCode==4719, "audit_policy_changed",
EventCode==7036 OR EventCode==7040, "service_state_change",
true(), null())
| where isnotnull(action)
| table _time, host, User, EventCode, action, CommandLine, Message
| sort - _timeComprehensive defense impairment detection using Sysmon process creation, System service events, and Security audit events. Categorizes impairment actions into service tampering, log tampering, Defender modification, boot/firewall changes, log clearing (1102), and audit policy changes (4719).
Data Sources
Required Sourcetypes
False Positives & Tuning
- IT administrators performing legitimate maintenance or reconfiguration of security tools during planned change windows
- Endpoint management tools (SCCM, Intune, GPO) updating Defender exclusions or policies
- Security tool upgrades that temporarily stop and restart services
Other platforms for T1562
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Stop Windows Defender Service
Expected signal: Sysmon Event ID 1: Process Create with CommandLine 'sc stop WinDefend'. System Event ID 7036: Windows Defender Antivirus Service entered the stopped state. Security Event ID 4688 if command line auditing enabled.
- Test 2Clear Security Event Log
Expected signal: Security Event ID 1102: The audit log was cleared. Sysmon Event ID 1: Process Create with CommandLine 'wevtutil cl Security'.
- Test 3Disable Audit Policy
Expected signal: Security Event ID 4719: System audit policy was changed. Sysmon Event ID 1: Process Create with CommandLine 'auditpol /clear /y'.
References (5)
- https://attack.mitre.org/techniques/T1562/
- https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations
- https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562/T1562.md
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
Unlock Pro Content
Get the full detection package for T1562 including response playbook, investigation guide, and atomic red team tests.
Related Detections
Sub-techniques (12)
- T1562.001Disable or Modify Tools
- T1562.002Disable Windows Event Logging
- T1562.003Impair Command History Logging
- T1562.004Disable or Modify System Firewall
- T1562.006Indicator Blocking
- T1562.007Disable or Modify Cloud Firewall
- T1562.008Disable or Modify Cloud Logs
- T1562.009Safe Mode Boot
- T1562.010Downgrade Attack
- T1562.011Spoof Security Alerting
- T1562.012Disable or Modify Linux Audit System
- T1562.013Disable or Modify Network Device Firewall