Detect Impair Defenses in Sumo Logic CSE
Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. This may span both native defenses as well as supplemental capabilities installed by users and administrators. Adversaries may also impair routine operations that contribute to defensive hygiene, such as blocking users from logging out, preventing a system from shutting down, or disabling or modifying the update process.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1562 Impair Defenses
- Canonical reference
- https://attack.mitre.org/techniques/T1562/
Sumo Detection Query
_sourceCategory=windows/sysmon OR _sourceCategory=windows/security OR _sourceCategory=windows/system
| where EventCode in ("1", "1102", "4688", "4719", "7036", "7040", "7045")
| eval action = if(
(EventCode in ("1", "4688")) and
matches(CommandLine, "(?i)(sc\s+(stop|config)|net\s+stop|taskkill).*(WinDefend|Sense|MsMpSvc|SecurityHealth|SecurityHealthService|EventLog|MpsSvc|WdNisSvc)"),
"security_service_tampering",
if(
(EventCode in ("1", "4688")) and
matches(CommandLine, "(?i)(auditpol\s+/(clear|set)|wevtutil\s+cl\s)"),
"log_tampering",
if(
(EventCode in ("1", "4688")) and
matches(CommandLine, "(?i)(Set-MpPreference|DisableRealtimeMonitoring|DisableBehaviorMonitoring|Remove-MpPreference)"),
"defender_modification",
if(
(EventCode in ("1", "4688")) and
matches(CommandLine, "(?i)(bcdedit\s+/set.{0,30}safeboot|netsh\s+advfirewall\s+set)"),
"boot_or_firewall_tampering",
if(EventCode == "1102", "audit_log_cleared",
if(EventCode == "4719", "audit_policy_changed",
if(EventCode in ("7036", "7040"), "service_state_change", null)
)
)
)
)
)
)
| where !isNull(action)
| fields _messageTime, host, User, EventCode, action, CommandLine, Message
| sort by _messageTime descDetects T1562 Impair Defenses across multiple Windows event sources by correlating Sysmon process creation events (EID 1), Security process creation (EID 4688), audit log cleared (EID 1102), audit policy changes (EID 4719), and service state changes (EID 7036/7040). Classifies each event by attack sub-type: security service tampering, log tampering, Defender modification, boot/firewall tampering, and audit policy changes.
Data Sources
Required Tables
False Positives & Tuning
- Windows Defender platform updates initiated by Microsoft Update that temporarily modify service state and Defender configuration settings
- IT asset management or vulnerability scanning tools that query or temporarily alter audit policies to perform privileged scans
- Group Policy application during machine startup or refresh cycles that alters firewall rules via netsh or service configurations
Other platforms for T1562
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Stop Windows Defender Service
Expected signal: Sysmon Event ID 1: Process Create with CommandLine 'sc stop WinDefend'. System Event ID 7036: Windows Defender Antivirus Service entered the stopped state. Security Event ID 4688 if command line auditing enabled.
- Test 2Clear Security Event Log
Expected signal: Security Event ID 1102: The audit log was cleared. Sysmon Event ID 1: Process Create with CommandLine 'wevtutil cl Security'.
- Test 3Disable Audit Policy
Expected signal: Security Event ID 4719: System audit policy was changed. Sysmon Event ID 1: Process Create with CommandLine 'auditpol /clear /y'.
References (5)
- https://attack.mitre.org/techniques/T1562/
- https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations
- https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562/T1562.md
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
Unlock Pro Content
Get the full detection package for T1562 including response playbook, investigation guide, and atomic red team tests.
Related Detections
Sub-techniques (12)
- T1562.001Disable or Modify Tools
- T1562.002Disable Windows Event Logging
- T1562.003Impair Command History Logging
- T1562.004Disable or Modify System Firewall
- T1562.006Indicator Blocking
- T1562.007Disable or Modify Cloud Firewall
- T1562.008Disable or Modify Cloud Logs
- T1562.009Safe Mode Boot
- T1562.010Downgrade Attack
- T1562.011Spoof Security Alerting
- T1562.012Disable or Modify Linux Audit System
- T1562.013Disable or Modify Network Device Firewall