T1562 Splunk · SPL

Detect Impair Defenses in Splunk

Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. This may span both native defenses as well as supplemental capabilities installed by users and administrators. Adversaries may also impair routine operations that contribute to defensive hygiene, such as blocking users from logging out, preventing a system from shutting down, or disabling or modifying the update process.

MITRE ATT&CK

Tactic
Defense Evasion
Technique
T1562 Impair Defenses
Canonical reference
https://attack.mitre.org/techniques/T1562/

SPL Detection Query

Splunk (SPL)
spl 
index=wineventlog (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1) OR (sourcetype="WinEventLog:System" EventCode IN (7036, 7040, 7045)) OR (sourcetype="WinEventLog:Security" EventCode IN (1102, 4719))
| eval action=case(
    EventCode==1 AND match(CommandLine, "(?i)(sc\s+(stop|config)|net\s+stop|taskkill).*(WinDefend|Sense|MsMpSvc|SecurityHealth|EventLog|MpsSvc)"), "service_tampering",
    EventCode==1 AND match(CommandLine, "(?i)(auditpol\s+/(clear|set)|wevtutil\s+cl)"), "log_tampering",
    EventCode==1 AND match(CommandLine, "(?i)(Set-MpPreference|DisableRealtimeMonitoring|DisableBehaviorMonitoring)"), "defender_modification",
    EventCode==1 AND match(CommandLine, "(?i)(bcdedit\s+/set\s+.*safeboot|netsh\s+advfirewall)"), "boot_or_firewall",
    EventCode==1102, "log_cleared",
    EventCode==4719, "audit_policy_changed",
    EventCode==7036 OR EventCode==7040, "service_state_change",
    true(), null())
| where isnotnull(action)
| table _time, host, User, EventCode, action, CommandLine, Message
| sort - _time
high severity medium confidence

Comprehensive defense impairment detection using Sysmon process creation, System service events, and Security audit events. Categorizes impairment actions into service tampering, log tampering, Defender modification, boot/firewall changes, log clearing (1102), and audit policy changes (4719).

Data Sources

Process: Process CreationWindows Event Log: SystemWindows Event Log: SecuritySysmon Event ID 1

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/OperationalWinEventLog:SystemWinEventLog:Security

False Positives & Tuning

  • IT administrators performing legitimate maintenance or reconfiguration of security tools during planned change windows
  • Endpoint management tools (SCCM, Intune, GPO) updating Defender exclusions or policies
  • Security tool upgrades that temporarily stop and restart services

Other platforms for T1562

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 Stop Windows Defender Service

    Expected signal: Sysmon Event ID 1: Process Create with CommandLine 'sc stop WinDefend'. System Event ID 7036: Windows Defender Antivirus Service entered the stopped state. Security Event ID 4688 if command line auditing enabled.

  2. Test 2 Clear Security Event Log

    Expected signal: Security Event ID 1102: The audit log was cleared. Sysmon Event ID 1: Process Create with CommandLine 'wevtutil cl Security'.

  3. Test 3 Disable Audit Policy

    Expected signal: Security Event ID 4719: System audit policy was changed. Sysmon Event ID 1: Process Create with CommandLine 'auditpol /clear /y'.

Last updated: 2026-04-21 Research depth: deep
References (4)

Response Playbook

Triage

  1. Identify which defensive component was targeted — was it AV/EDR, event logging, firewall, or audit policy?
  2. Check the user context — is this a privileged admin account with a corresponding change ticket, or an unexpected user?
  3. Determine if the impairment was successful — did the service actually stop, was the registry key changed, was the log cleared?
  4. Look for temporal correlation — did other suspicious activity occur immediately before or after the defensive impairment?
  5. Check for lateral movement indicators — was the same impairment command executed across multiple hosts?

Containment

  1. If EDR/AV was disabled: immediately isolate the endpoint via network segmentation or EDR isolation capability
  2. If event logging was cleared or disabled: preserve remaining logs from SIEM, begin forensic imaging of the endpoint
  3. If firewall was disabled: re-enable firewall rules and block any newly opened ports at the network perimeter
  4. If audit policy was modified: restore audit policy from GPO baseline and force a gpupdate
  5. If multiple hosts affected: consider domain-wide credential reset and hunting for persistence mechanisms

Evidence Collection

  1. Windows Security Event Log — Event ID 1102 (log cleared), 4719 (audit policy changed), 4688 (process creation)
  2. System Event Log — Event ID 7036 (service state change), 7040 (service start type changed), 7045 (new service installed)
  3. Sysmon Event ID 1 (process creation), Event ID 12/13 (registry modifications)
  4. PowerShell ScriptBlock Logging — Event ID 4104 for Set-MpPreference or other Defender modification commands
  5. Registry hives — HKLM\SYSTEM\CurrentControlSet\Services for service configuration changes
  6. Memory forensics — volatile data may reveal in-memory hooks or patches to security tool DLLs

Escalation Criteria

  • !Multiple defense impairment techniques observed on the same host within a short time window (kill chain progression)
  • !Defense impairment followed by data exfiltration, lateral movement, or encryption activity
  • !Impairment detected on domain controllers, critical servers, or privileged access workstations
  • !Unknown or compromised account performing the impairment
  • !Evidence of BYOVD (Bring Your Own Vulnerable Driver) used to disable security tools at kernel level

Investigation Guide

Related Techniques

T1562.001 — Disable or Modify ToolsT1562.002 — Disable Windows Event LoggingT1562.004 — Disable or Modify System FirewallT1562.006 — Indicator BlockingT1562.009 — Safe Mode BootT1070.001 — Clear Windows Event LogsT1112 — Modify RegistryT1543.003 — Windows Service

Forensic Artifacts

  • >Registry: HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName>\Start — service start type values
  • >Registry: HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-* — event log autologger configuration
  • >Registry: HKLM\SOFTWARE\Microsoft\Windows Defender — Defender configuration and exclusions
  • >File System: C:\Windows\System32\winevt\Logs\ — event log files (.evtx) for timeline analysis
  • >Event Log: Security Event ID 1102 — provides the account that cleared the log
  • >WMI: Win32_Service for current service states and start types

Tuning Guidance

This parent detection is intentionally broad. Start by correlating alerts with your change management system — legitimate maintenance should have corresponding tickets. Build an allowlist for known admin accounts and their typical maintenance patterns. Consider splitting this into sub-detections per impairment category (service stopping, log clearing, firewall modification) for more granular tuning. Exclude known endpoint management tool service accounts (SCCM, Intune agent accounts) but only by exact account name match, never by command pattern.

Hunting Queries

Hunt for accounts or processes that have attempted to stop or reconfigure security services across the environment. High counts or multiple affected devices indicate coordinated defense impairment.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has_any ("sc stop", "sc config", "net stop", "taskkill")
| where ProcessCommandLine has_any ("WinDefend", "Sense", "MsMpSvc", "SecurityHealth", "EventLog", "CrowdStrike", "Carbon", "Tanium", "Sentinel")
| summarize Count=count(), Devices=dcount(DeviceName) by AccountName, ProcessCommandLine
| sort by Count desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (CommandLine="*sc stop*" OR CommandLine="*sc config*" OR CommandLine="*net stop*" OR CommandLine="*taskkill*") (CommandLine="*WinDefend*" OR CommandLine="*Sense*" OR CommandLine="*MsMpSvc*" OR CommandLine="*SecurityHealth*" OR CommandLine="*EventLog*" OR CommandLine="*CrowdStrike*")
| stats count as Count, dc(host) as Devices by User, CommandLine
| sort - Count

Hunt for registry modifications targeting Windows Defender settings or event log autologger configuration. These modifications can silently disable security monitoring without stopping services.

Hunting — KQL
kql 
DeviceRegistryEvents
| where Timestamp > ago(7d)
| where RegistryKey has "Windows Defender" or RegistryKey has "WMI\\Autologger\\EventLog"
| where ActionType == "RegistryValueSet"
| where RegistryValueName in ("DisableRealtimeMonitoring", "DisableBehaviorMonitoring", "Start", "Enabled", "DisableAntiSpyware")
| project Timestamp, DeviceName, AccountName, RegistryKey, RegistryValueName, RegistryValueData
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=13 OR EventCode=14) (TargetObject="*Windows Defender*" OR TargetObject="*Autologger*EventLog*") (TargetObject="*DisableRealtimeMonitoring*" OR TargetObject="*DisableBehaviorMonitoring*" OR TargetObject="*DisableAntiSpyware*" OR TargetObject="*Start*" OR TargetObject="*Enabled*")
| table _time, host, User, EventCode, TargetObject, Details
| sort - _time

Atomic Red Team Tests

Test 1 Stop Windows Defender Service
windows

Attempts to stop the Windows Defender service using sc.exe. This simulates ransomware and malware that disable AV before deploying payloads. Requires elevated privileges.

Command

powershell 
sc stop WinDefend

Cleanup

powershell 
sc start WinDefend

Expected Telemetry

Sysmon Event ID 1: Process Create with CommandLine 'sc stop WinDefend'. System Event ID 7036: Windows Defender Antivirus Service entered the stopped state. Security Event ID 4688 if command line auditing enabled.

Expected Detection

Alert fires on 'sc stop' + 'WinDefend' pattern. KQL: StoppedService='WinDefend', IsSecurityService=true. SPL: action='service_tampering'.

Test 2 Clear Security Event Log
windows

Clears the Windows Security event log using wevtutil. This is a common post-exploitation technique to cover tracks. Generates Security Event ID 1102.

Command

powershell 
wevtutil cl Security

Expected Telemetry

Security Event ID 1102: The audit log was cleared. Sysmon Event ID 1: Process Create with CommandLine 'wevtutil cl Security'.

Expected Detection

Alert fires on 'wevtutil cl' pattern and Event ID 1102. SPL: action='log_cleared' or action='log_tampering'.

Test 3 Disable Audit Policy
windows

Uses auditpol to clear all audit policies, preventing Windows from logging security events. This technique was used by Magic Hound (APT35) to evade detection.

Command

powershell 
auditpol /clear /y

Cleanup

powershell 
auditpol /set /category:* /success:enable /failure:enable

Expected Telemetry

Security Event ID 4719: System audit policy was changed. Sysmon Event ID 1: Process Create with CommandLine 'auditpol /clear /y'.

Expected Detection

Alert fires on 'auditpol /clear' pattern and Event ID 4719. SPL: action='audit_policy_changed' or action='log_tampering'.

Related Detections

Tactic Hub

TA0005 Defense Evasion

Sub-techniques (12)

Related Techniques

T1562.001 Disable or Modify Tools T1562.002 Disable Windows Event Logging T1562.004 Disable or Modify System Firewall T1562.006 Indicator Blocking T1562.009 Safe Mode Boot T1070.001 Clear Windows Event Logs T1112 Modify Registry T1543.003 Windows Service

Same Tactic: Defense Evasion

Popular Detections