Skip to content
T1685 Microsoft Sentinel · KQL

Detect Disable or Modify Tools in Microsoft Sentinel

Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying/deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems. Additionally, adversaries may exploit legitimate drivers from anti-virus software to gain kernel access (BYOVD), abuse the Windows TTD monitor driver to debug and suspend EDR processes, or unhook userland DLLs to bypass security tool instrumentation.

MITRE ATT&CK

Tactic
Defense Impairment
Technique
T1685 Disable or Modify Tools
Canonical reference
https://attack.mitre.org/techniques/T1685/

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
let SecurityProcesses = dynamic(["MsMpEng.exe", "MsSense.exe", "SenseCncProxy.exe", "SenseIR.exe", "SenseSampleUploader.exe", "SecurityHealthService.exe", "SecurityHealthSystray.exe", "csfalconservice.exe", "csfalconcontainer.exe", "CylanceSvc.exe", "cb.exe", "CbDefense.exe", "SentinelAgent.exe", "SentinelServiceHost.exe", "taniumclient.exe", "TmCCSF.exe", "coreServiceShell.exe"]);
let SecurityServices = dynamic(["WinDefend", "Sense", "MsMpSvc", "WdNisSvc", "SecurityHealthService", "wscsvc", "CrowdStrike", "CylanceSvc", "CbDefense", "SentinelAgent"]);
let SuspiciousActions = dynamic(["sc stop", "sc delete", "sc config", "net stop", "taskkill /f /im", "Set-MpPreference -DisableRealtimeMonitoring", "Set-MpPreference -DisableBehaviorMonitoring", "Set-MpPreference -DisableIOAVProtection", "Set-MpPreference -DisableScriptScanning", "Add-MpPreference -ExclusionPath", "Add-MpPreference -ExclusionProcess", "Set-MpPreference -DisableBlockAtFirstSeen", "DisableAntiSpyware", "SystemSettingsAdminFlows.exe"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any (SuspiciousActions)
   or (FileName =~ "taskkill.exe" and ProcessCommandLine has_any (SecurityProcesses))
   or (FileName in~ ("sc.exe", "net.exe", "net1.exe") and ProcessCommandLine has_any (SecurityServices))
| extend TargetTool = case(
    ProcessCommandLine has_any ("WinDefend", "MsMpEng", "MsSense", "Sense", "Defender"), "Windows Defender/MDE",
    ProcessCommandLine has_any ("CrowdStrike", "csfalcon"), "CrowdStrike Falcon",
    ProcessCommandLine has_any ("Cylance"), "Cylance",
    ProcessCommandLine has_any ("Carbon", "CbDefense", "cb.exe"), "Carbon Black",
    ProcessCommandLine has_any ("Sentinel"), "SentinelOne",
    ProcessCommandLine has_any ("Tanium", "taniumclient"), "Tanium",
    ProcessCommandLine has_any ("ExclusionPath", "ExclusionProcess"), "Defender Exclusion",
    "Other/Unknown")
| extend ActionType2 = case(
    ProcessCommandLine has "taskkill", "Process Kill",
    ProcessCommandLine has "sc stop" or ProcessCommandLine has "net stop", "Service Stop",
    ProcessCommandLine has "sc delete", "Service Delete",
    ProcessCommandLine has "sc config", "Service Reconfigure",
    ProcessCommandLine has "MpPreference", "Defender Policy Change",
    ProcessCommandLine has "Exclusion", "Exclusion Added",
    "Other")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, TargetTool, ActionType2
| sort by Timestamp desc
critical severity high confidence

Detects attempts to disable, stop, kill, delete, or modify security tool processes and services. Covers Windows Defender, MDE Sense, CrowdStrike Falcon, CylanceProtect, Carbon Black, SentinelOne, and Tanium. Also detects Defender exclusion additions and preference modifications that weaken protection. Uses MDE DeviceProcessEvents for process creation monitoring.

Data Sources

Process: Process CreationCommand: Command ExecutionService: Service MetadataMicrosoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives & Tuning

  • IT administrators performing planned security tool maintenance, upgrades, or migrations with corresponding change tickets
  • Endpoint management tools (SCCM, Intune) deploying Defender exclusion policies for legitimate applications
  • Security tool uninstallation during agent version upgrades or vendor transitions
  • Automated remediation scripts that restart security services after patching

Other platforms for T1685

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 Stop Windows Defender via sc.exe

    Expected signal: Sysmon Event ID 1: sc.exe with CommandLine containing 'stop WinDefend'. System Event ID 7036: WinDefend service entered stopped state. System Event ID 7040: WinDefend start type changed to disabled.

  2. Test 2 Add Defender Exclusion for C: Drive

    Expected signal: Sysmon Event ID 1: powershell.exe with CommandLine containing 'Add-MpPreference -ExclusionPath'. Sysmon Event ID 13: Registry value set under HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths. PowerShell ScriptBlock Log Event ID 4104. Defender Event ID 5007 (config changed).

  3. Test 3 Kill Security Process with taskkill

    Expected signal: Sysmon Event ID 1: taskkill.exe with CommandLine containing '/f /im MsMpEng.exe'. The kill will likely fail due to tamper protection, but the process creation event fires regardless.

  4. Test 4 Disable Defender Real-Time Protection via Registry

    Expected signal: Sysmon Event ID 1: reg.exe with CommandLine containing DisableRealtimeMonitoring. Sysmon Event ID 13: Registry value set. Defender Event ID 5001: Real-time protection disabled.

Last updated: 2026-04-21 Research depth: deep
References (5)

Response Playbook

Triage

  1. Identify the exact security tool targeted and whether the tampering was successful (check current service state and process list)
  2. Check the parent process chain — was the command spawned by a known malware dropper, LOLBin, or suspicious script?
  3. Verify user context — is this a domain admin, local admin, or service account? Does it match the expected admin for this system?
  4. Look for preceding activity — was there a BYOVD driver load, privilege escalation, or lateral movement event before the tool was disabled?
  5. Check if Defender exclusions were added — if so, examine what paths/processes were excluded and whether files exist there
  6. Correlate with EDR telemetry gaps — is there a period of missing events from the endpoint after the tool was disabled?

Containment

  1. Immediately isolate the endpoint from the network using EDR isolation or VLAN change
  2. Re-enable the disabled security tool remotely (via GPO push, SCCM task sequence, or EDR remote command)
  3. If BYOVD was used: identify and block the vulnerable driver hash; add to driver blocklist
  4. If Defender exclusions were added: remove all unauthorized exclusions via Set-MpPreference -ExclusionPath @()
  5. Reset credentials for the account that performed the tampering
  6. If multiple hosts affected: push emergency GPO to force-enable security services and remove exclusions

Evidence Collection

  1. Sysmon Event ID 1 — full process creation chain including parent process
  2. Sysmon Event ID 6 — driver loaded events for BYOVD detection
  3. Sysmon Event ID 12/13 — registry modifications to security tool configuration keys
  4. System Event ID 7036 — service state changes (started/stopped)
  5. System Event ID 7040 — service start type changes (auto/disabled)
  6. PowerShell ScriptBlock Logging Event ID 4104 — for Set-MpPreference commands
  7. Windows Defender Operational Log — Event IDs 5001 (real-time protection disabled), 5010 (scanning disabled), 5012 (updates disabled)
  8. File system: C:\ProgramData\Microsoft\Windows Defender\Support\MPLog-*.log — Defender operational logs

Escalation Criteria

  • !Security tool disabled with no corresponding change ticket or maintenance window
  • !BYOVD driver loaded followed by security tool process termination
  • !Multiple security tools disabled on the same host (defense-in-depth being systematically dismantled)
  • !Tool disabled on a domain controller, certificate authority, or other critical infrastructure host
  • !Defender exclusion added for C:\ or broad paths covering entire drives
  • !Tool disablement followed by ransomware indicators (mass file encryption, ransom note creation)

Investigation Guide

Forensic Artifacts

  • >Registry: HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection — DisableRealtimeMonitoring, DisableBehaviorMonitoring values
  • >Registry: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender — DisableAntiSpyware value
  • >Registry: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths — added exclusion paths
  • >Registry: HKLM\SYSTEM\CurrentControlSet\Services\WinDefend\Start — service start type (2=auto, 4=disabled)
  • >File System: C:\ProgramData\Microsoft\Windows Defender\Quarantine\ — quarantined items before tool was disabled
  • >WMI: Win32_Service WHERE Name='WinDefend' — current service state and start type
  • >Event Log: Microsoft-Windows-Windows Defender/Operational — Event IDs 5001-5013 for Defender state changes

Tuning Guidance

Build an allowlist of accounts and parent processes authorized to manage security tools. Common legitimate sources include SCCM (CcmExec.exe), Intune management extension, GPO-applied scripts, and security tool update processes. Exclude these by exact parent process + account combinations. Never exclude by command pattern alone. For Defender exclusion monitoring, maintain a baseline of approved exclusion paths from your GPO and alert on any additions not in the baseline. Consider raising severity to critical when multiple security tools are targeted on the same host.

Hunting Queries

Hunt for security tool process/service tampering across the environment. High counts or multi-device spread indicate coordinated pre-ransomware activity.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "taskkill.exe" or (FileName in~ ("sc.exe", "net.exe", "net1.exe") and ProcessCommandLine has_any ("stop", "delete", "config"))
| where ProcessCommandLine has_any ("MsMpEng", "Sense", "WinDefend", "csfalcon", "CrowdStrike", "Cylance", "CbDefense", "Sentinel", "Tanium", "SecurityHealth")
| summarize Count=count(), Devices=dcount(DeviceName), Earliest=min(Timestamp), Latest=max(Timestamp) by AccountName, ProcessCommandLine, InitiatingProcessFileName
| sort by Count desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\taskkill.exe" OR Image="*\\sc.exe" OR Image="*\\net.exe" OR Image="*\\net1.exe") (CommandLine="*WinDefend*" OR CommandLine="*MsMpEng*" OR CommandLine="*Sense*" OR CommandLine="*CrowdStrike*" OR CommandLine="*csfalcon*" OR CommandLine="*Cylance*" OR CommandLine="*CbDefense*" OR CommandLine="*Sentinel*" OR CommandLine="*Tanium*")
| stats count, dc(host) as Devices, earliest(_time) as Earliest, latest(_time) as Latest by User, CommandLine, ParentImage
| sort - count

Hunt for Windows Defender exclusion additions. Adversaries often add broad exclusions (C:\, entire user profiles, or specific malware paths) before deploying payloads. Legitimate exclusions should be managed via GPO, not local changes.

Hunting — KQL
kql 
DeviceRegistryEvents
| where Timestamp > ago(7d)
| where RegistryKey has "Windows Defender\\Exclusions"
| where ActionType == "RegistryValueSet"
| project Timestamp, DeviceName, AccountName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=12 OR EventCode=13) TargetObject="*Windows Defender*Exclusions*"
| table _time, host, User, EventCode, TargetObject, Details, Image
| sort - _time

Hunt for PowerShell-based Defender preference modifications. Legitimate changes typically come from SCCM/Intune agents, not interactive PowerShell sessions.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "powershell.exe" or FileName =~ "pwsh.exe"
| where ProcessCommandLine has "Set-MpPreference" or ProcessCommandLine has "Add-MpPreference"
| where ProcessCommandLine has_any ("Disable", "Exclusion", "$true")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\powershell.exe" OR Image="*\\pwsh.exe") (CommandLine="*Set-MpPreference*" OR CommandLine="*Add-MpPreference*") (CommandLine="*Disable*" OR CommandLine="*Exclusion*")
| table _time, host, User, CommandLine, ParentImage
| sort - _time

Atomic Red Team Tests

Test 1 Stop Windows Defender via sc.exe
windows

Uses sc.exe to stop the WinDefend service. This is the most common technique observed in ransomware families including Ryuk, REvil, Conti, and Diavol. Requires SYSTEM or administrator privileges.

Command

powershell 
sc stop WinDefend && sc config WinDefend start=disabled

Cleanup

powershell 
sc config WinDefend start=auto && sc start WinDefend

Expected Telemetry

Sysmon Event ID 1: sc.exe with CommandLine containing 'stop WinDefend'. System Event ID 7036: WinDefend service entered stopped state. System Event ID 7040: WinDefend start type changed to disabled.

Expected Detection

KQL: TargetTool='Windows Defender/MDE', ActionType2='Service Stop'. SPL: ServiceKill=1, TargetTool='Windows Defender/MDE'.

Test 2 Add Defender Exclusion for C: Drive
windows

Adds the entire C:\ drive to Windows Defender exclusions, effectively blinding Defender to all files on the system drive. Used by WhisperGate, XLoader, and FIN13.

Command

powershell 
powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:\'"

Cleanup

powershell 
powershell.exe -Command "Remove-MpPreference -ExclusionPath 'C:\'"

Expected Telemetry

Sysmon Event ID 1: powershell.exe with CommandLine containing 'Add-MpPreference -ExclusionPath'. Sysmon Event ID 13: Registry value set under HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths. PowerShell ScriptBlock Log Event ID 4104. Defender Event ID 5007 (config changed).

Expected Detection

KQL: TargetTool='Defender Exclusion', ActionType2='Exclusion Added'. SPL: DefenderModify=1.

Test 3 Kill Security Process with taskkill
windows

Uses taskkill to forcefully terminate a security tool process. Simulates malware that terminates AV processes before deploying payloads. Many EDR tools have tamper protection that will prevent this, but the attempt still generates telemetry.

Command

powershell 
taskkill /f /im MsMpEng.exe

Expected Telemetry

Sysmon Event ID 1: taskkill.exe with CommandLine containing '/f /im MsMpEng.exe'. The kill will likely fail due to tamper protection, but the process creation event fires regardless.

Expected Detection

KQL: TargetTool='Windows Defender/MDE', ActionType2='Process Kill'. SPL: ProcessKill=1.

Test 4 Disable Defender Real-Time Protection via Registry
windows

Directly sets the DisableRealtimeMonitoring registry value to disable Defender real-time protection. This bypasses PowerShell cmdlet logging by using reg.exe directly.

Command

powershell 
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f

Cleanup

powershell 
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /f

Expected Telemetry

Sysmon Event ID 1: reg.exe with CommandLine containing DisableRealtimeMonitoring. Sysmon Event ID 13: Registry value set. Defender Event ID 5001: Real-time protection disabled.

Expected Detection

Registry monitoring detects the DisableRealtimeMonitoring value being set to 1.

Related Detections

Tactic Hub

TA0112 Defense Impairment ATT&CK Matrix

Sub-techniques (7)

Related Techniques

T1562 Impair Defenses T1562.006 Indicator Blocking T1543.003 Windows Service T1112 Modify Registry T1068 Exploitation for Privilege Escalation T1564.012 File/Path Exclusions

Same Tactic: Defense Impairment

Popular Detections