Detect Disable or Modify Tools in CrowdStrike LogScale
Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying/deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems. Additionally, adversaries may exploit legitimate drivers from anti-virus software to gain kernel access (BYOVD), abuse the Windows TTD monitor driver to debug and suspend EDR processes, or unhook userland DLLs to bypass security tool instrumentation.
MITRE ATT&CK
- Tactic
- Defense Impairment
- Technique
- T1685 Disable or Modify Tools
- Canonical reference
- https://attack.mitre.org/techniques/T1685/
LogScale Detection Query
#event_simpleName=ProcessRollup2
| ImageFileName = /(?i)(sc\.exe|net\.exe|net1\.exe|taskkill\.exe|powershell\.exe|pwsh\.exe)$/
| CommandLine = /(?i)(sc\s+(stop|delete|config)|net\s+stop|net1\s+stop|taskkill.*\/f|set-mppreference|add-mppreference)/
| CommandLine = /(?i)(windefend|sense|msmpsvc|wdnissvc|securityhealth|wscsvc|crowdstrike|csfalcon|cylance|cbdefense|sentinelagent|taniumclient|msmpeng|mssense|sentinelservicehost|disable|exclusionpath|exclusionprocess|disableantispyware)/
| eval TargetTool = case(
CommandLine = /(?i)(windefend|msmpeng|mssense|sense|defender)/, "Windows Defender/MDE",
CommandLine = /(?i)(crowdstrike|csfalcon)/, "CrowdStrike Falcon",
CommandLine = /(?i)cylance/, "Cylance",
CommandLine = /(?i)(carbon|cbdefense)/, "Carbon Black",
CommandLine = /(?i)sentinel/, "SentinelOne",
CommandLine = /(?i)tanium/, "Tanium",
"Other/Unknown")
| eval ActionType = case(
CommandLine = /(?i)taskkill/, "Process Kill",
CommandLine = /(?i)(sc\s+stop|net\s+stop)/, "Service Stop",
CommandLine = /(?i)sc\s+delete/, "Service Delete",
CommandLine = /(?i)sc\s+config/, "Service Reconfigure",
CommandLine = /(?i)(set-mppreference|add-mppreference)/, "Defender Policy Change",
CommandLine = /(?i)exclusion/, "Exclusion Added",
"Other")
| table([timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, TargetTool, ActionType])
| sort(timestamp, order=desc)Detects security tool disable or modification activity in CrowdStrike Falcon LogScale (CQL) by filtering ProcessRollup2 events for service control, taskkill, and PowerShell Defender modification commands targeting known AV/EDR products across Windows endpoints (T1562.001).
Data Sources
Required Tables
False Positives & Tuning
- Falcon sensor upgrades or configuration changes pushed by the CrowdStrike console that involve service restarts on managed endpoints
- Third-party ITSM integrations that automate exclusion management via PowerShell as part of approved application onboarding workflows
- Enterprise software packaging tools that disable AV scanning temporarily during MSI installation to prevent false detection of installation artifacts
Other platforms for T1685
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Stop Windows Defender via sc.exe
Expected signal: Sysmon Event ID 1: sc.exe with CommandLine containing 'stop WinDefend'. System Event ID 7036: WinDefend service entered stopped state. System Event ID 7040: WinDefend start type changed to disabled.
- Test 2 Add Defender Exclusion for C: Drive
Expected signal: Sysmon Event ID 1: powershell.exe with CommandLine containing 'Add-MpPreference -ExclusionPath'. Sysmon Event ID 13: Registry value set under HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths. PowerShell ScriptBlock Log Event ID 4104. Defender Event ID 5007 (config changed).
- Test 3 Kill Security Process with taskkill
Expected signal: Sysmon Event ID 1: taskkill.exe with CommandLine containing '/f /im MsMpEng.exe'. The kill will likely fail due to tamper protection, but the process creation event fires regardless.
- Test 4 Disable Defender Real-Time Protection via Registry
Expected signal: Sysmon Event ID 1: reg.exe with CommandLine containing DisableRealtimeMonitoring. Sysmon Event ID 13: Registry value set. Defender Event ID 5001: Real-time protection disabled.
References (5)
- https://attack.mitre.org/techniques/T1685/
- https://www.sentinelone.com/labs/fin7-reboot-cybercrime-gang-enhances-ops-with-new-edr-bypasses-and-automated-attacks/
- https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/
- https://cdn.logic-control.com/docs/scadafence/Anatomy-Of-A-Targeted-Ransomware-Attack-WP.pdf
- https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/demystifying-ransomware-attacks-against-microsoft-defender/ba-p/1928947
Response Playbook
Triage
- Identify the exact security tool targeted and whether the tampering was successful (check current service state and process list)
- Check the parent process chain — was the command spawned by a known malware dropper, LOLBin, or suspicious script?
- Verify user context — is this a domain admin, local admin, or service account? Does it match the expected admin for this system?
- Look for preceding activity — was there a BYOVD driver load, privilege escalation, or lateral movement event before the tool was disabled?
- Check if Defender exclusions were added — if so, examine what paths/processes were excluded and whether files exist there
- Correlate with EDR telemetry gaps — is there a period of missing events from the endpoint after the tool was disabled?
Containment
- Immediately isolate the endpoint from the network using EDR isolation or VLAN change
- Re-enable the disabled security tool remotely (via GPO push, SCCM task sequence, or EDR remote command)
- If BYOVD was used: identify and block the vulnerable driver hash; add to driver blocklist
- If Defender exclusions were added: remove all unauthorized exclusions via Set-MpPreference -ExclusionPath @()
- Reset credentials for the account that performed the tampering
- If multiple hosts affected: push emergency GPO to force-enable security services and remove exclusions
Evidence Collection
- Sysmon Event ID 1 — full process creation chain including parent process
- Sysmon Event ID 6 — driver loaded events for BYOVD detection
- Sysmon Event ID 12/13 — registry modifications to security tool configuration keys
- System Event ID 7036 — service state changes (started/stopped)
- System Event ID 7040 — service start type changes (auto/disabled)
- PowerShell ScriptBlock Logging Event ID 4104 — for Set-MpPreference commands
- Windows Defender Operational Log — Event IDs 5001 (real-time protection disabled), 5010 (scanning disabled), 5012 (updates disabled)
- File system: C:\ProgramData\Microsoft\Windows Defender\Support\MPLog-*.log — Defender operational logs
Escalation Criteria
- !Security tool disabled with no corresponding change ticket or maintenance window
- !BYOVD driver loaded followed by security tool process termination
- !Multiple security tools disabled on the same host (defense-in-depth being systematically dismantled)
- !Tool disabled on a domain controller, certificate authority, or other critical infrastructure host
- !Defender exclusion added for C:\ or broad paths covering entire drives
- !Tool disablement followed by ransomware indicators (mass file encryption, ransom note creation)
Investigation Guide
Forensic Artifacts
- >
Registry: HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection — DisableRealtimeMonitoring, DisableBehaviorMonitoring values - >
Registry: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender — DisableAntiSpyware value - >
Registry: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths — added exclusion paths - >
Registry: HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\Start — service start type (2=auto, 4=disabled) - >
File System: C:\ProgramData\Microsoft\Windows Defender\Quarantine\ — quarantined items before tool was disabled - >
WMI: Win32_Service WHERE Name='WinDefend' — current service state and start type - >
Event Log: Microsoft-Windows-Windows Defender/Operational — Event IDs 5001-5013 for Defender state changes
Tuning Guidance
Build an allowlist of accounts and parent processes authorized to manage security tools. Common legitimate sources include SCCM (CcmExec.exe), Intune management extension, GPO-applied scripts, and security tool update processes. Exclude these by exact parent process + account combinations. Never exclude by command pattern alone. For Defender exclusion monitoring, maintain a baseline of approved exclusion paths from your GPO and alert on any additions not in the baseline. Consider raising severity to critical when multiple security tools are targeted on the same host.
Hunting Queries
Hunt for security tool process/service tampering across the environment. High counts or multi-device spread indicate coordinated pre-ransomware activity.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "taskkill.exe" or (FileName in~ ("sc.exe", "net.exe", "net1.exe") and ProcessCommandLine has_any ("stop", "delete", "config"))
| where ProcessCommandLine has_any ("MsMpEng", "Sense", "WinDefend", "csfalcon", "CrowdStrike", "Cylance", "CbDefense", "Sentinel", "Tanium", "SecurityHealth")
| summarize Count=count(), Devices=dcount(DeviceName), Earliest=min(Timestamp), Latest=max(Timestamp) by AccountName, ProcessCommandLine, InitiatingProcessFileName
| sort by Count descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\taskkill.exe" OR Image="*\\sc.exe" OR Image="*\\net.exe" OR Image="*\\net1.exe") (CommandLine="*WinDefend*" OR CommandLine="*MsMpEng*" OR CommandLine="*Sense*" OR CommandLine="*CrowdStrike*" OR CommandLine="*csfalcon*" OR CommandLine="*Cylance*" OR CommandLine="*CbDefense*" OR CommandLine="*Sentinel*" OR CommandLine="*Tanium*")
| stats count, dc(host) as Devices, earliest(_time) as Earliest, latest(_time) as Latest by User, CommandLine, ParentImage
| sort - countHunt for Windows Defender exclusion additions. Adversaries often add broad exclusions (C:\, entire user profiles, or specific malware paths) before deploying payloads. Legitimate exclusions should be managed via GPO, not local changes.
DeviceRegistryEvents
| where Timestamp > ago(7d)
| where RegistryKey has "Windows Defender\\Exclusions"
| where ActionType == "RegistryValueSet"
| project Timestamp, DeviceName, AccountName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=12 OR EventCode=13) TargetObject="*Windows Defender*Exclusions*"
| table _time, host, User, EventCode, TargetObject, Details, Image
| sort - _timeHunt for PowerShell-based Defender preference modifications. Legitimate changes typically come from SCCM/Intune agents, not interactive PowerShell sessions.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "powershell.exe" or FileName =~ "pwsh.exe"
| where ProcessCommandLine has "Set-MpPreference" or ProcessCommandLine has "Add-MpPreference"
| where ProcessCommandLine has_any ("Disable", "Exclusion", "$true")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\powershell.exe" OR Image="*\\pwsh.exe") (CommandLine="*Set-MpPreference*" OR CommandLine="*Add-MpPreference*") (CommandLine="*Disable*" OR CommandLine="*Exclusion*")
| table _time, host, User, CommandLine, ParentImage
| sort - _timeAtomic Red Team Tests
Uses sc.exe to stop the WinDefend service. This is the most common technique observed in ransomware families including Ryuk, REvil, Conti, and Diavol. Requires SYSTEM or administrator privileges.
Command
sc stop WinDefend && sc config WinDefend start=disabledCleanup
sc config WinDefend start=auto && sc start WinDefendExpected Telemetry
Sysmon Event ID 1: sc.exe with CommandLine containing 'stop WinDefend'. System Event ID 7036: WinDefend service entered stopped state. System Event ID 7040: WinDefend start type changed to disabled.
Expected Detection
KQL: TargetTool='Windows Defender/MDE', ActionType2='Service Stop'. SPL: ServiceKill=1, TargetTool='Windows Defender/MDE'.
Adds the entire C:\ drive to Windows Defender exclusions, effectively blinding Defender to all files on the system drive. Used by WhisperGate, XLoader, and FIN13.
Command
powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:\'"Cleanup
powershell.exe -Command "Remove-MpPreference -ExclusionPath 'C:\'"Expected Telemetry
Sysmon Event ID 1: powershell.exe with CommandLine containing 'Add-MpPreference -ExclusionPath'. Sysmon Event ID 13: Registry value set under HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths. PowerShell ScriptBlock Log Event ID 4104. Defender Event ID 5007 (config changed).
Expected Detection
KQL: TargetTool='Defender Exclusion', ActionType2='Exclusion Added'. SPL: DefenderModify=1.
Uses taskkill to forcefully terminate a security tool process. Simulates malware that terminates AV processes before deploying payloads. Many EDR tools have tamper protection that will prevent this, but the attempt still generates telemetry.
Command
taskkill /f /im MsMpEng.exeExpected Telemetry
Sysmon Event ID 1: taskkill.exe with CommandLine containing '/f /im MsMpEng.exe'. The kill will likely fail due to tamper protection, but the process creation event fires regardless.
Expected Detection
KQL: TargetTool='Windows Defender/MDE', ActionType2='Process Kill'. SPL: ProcessKill=1.
Directly sets the DisableRealtimeMonitoring registry value to disable Defender real-time protection. This bypasses PowerShell cmdlet logging by using reg.exe directly.
Command
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /fCleanup
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /fExpected Telemetry
Sysmon Event ID 1: reg.exe with CommandLine containing DisableRealtimeMonitoring. Sysmon Event ID 13: Registry value set. Defender Event ID 5001: Real-time protection disabled.
Expected Detection
Registry monitoring detects the DisableRealtimeMonitoring value being set to 1.