T1685 Disable or Modify Tools

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabi… MITRE ATT&CK

5 programs on CmdID 63 Sigma rules T1685 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK

T1685.001Disable or Modify Tools: Disable or Modify Windows Event Log

T1685.004Disable or Modify Tools: Disable or Modify Linux Audit System Log

T1685.005Disable or Modify Tools: Clear Windows Event Logs

T1685.006Disable or Modify Tools: Clear Linux or Mac System Logs

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

fltmc.exeits Sigma rules reg.exeits Sigma rules sc.exeits Sigma rules serviceits Sigma rules wmic.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first

highAdd SafeBoot Keys Via Reg UtilityNasreddine Bencherchali (Nextron Systems) · Windows

highDevcon Execution Disabling VMware VMCI DeviceMatt Anderson, Dray Agha, Anna Pham (Huntress) · Windows

highDisable Windows Defender AV Security Monitoringok @securonix invrep-de, oscd.community, frack113 · Windows

highDisabled IE Security FeaturesFlorian Roth (Nextron Systems) · Windows

highDisabled Volume SnapshotsFlorian Roth (Nextron Systems) · Windows

highDisabling Windows Defender WMI Autologger Session via Reg.exeMatt Anderson (Huntress) · Windows

highETW Logging Tamper In .NET Processes Via CommandLineRoberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) · Windows

highETW Trace Evasion Activity@neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community · Windows

highHackTool - Defendnot ExecutionSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

highHacktool - EDR-Freeze ExecutionSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

highHackTool - EDRSilencer Execution@gott_cyber · Windows

highHackTool - PowerTool ExecutionNasreddine Bencherchali (Nextron Systems) · Windows

highHackTool - Stracciatella ExecutionpH-T (Nextron Systems) · Windows

highHypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

highKaspersky Endpoint Security Stopped Via CommandLine - LinuxMilad Cheraghi · Linux

highObfuscated PowerShell OneLiner Execution@Kostastsale, TheDFIRReport · Windows

highPotential AMSI Bypass Via .NET ReflectionMarkus Neis, @Kostastsale · Windows

highPotential Ke3chang/TidePool Malware ActivityMarkus Neis, Swisscom · Windows

highPotential Tampering With Security Products Via WMICFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows

highPotential Windows Defender Tampering Via Wmic.EXEfrack113 · Windows

highPowershell Base64 Encoded MpPreference CmdletFlorian Roth (Nextron Systems) · Windows

highPowershell Defender Disable Scan FeatureFlorian Roth (Nextron Systems) · Windows

highPowerShell Defender Threat Severity Default Action Set to 'Allow' or 'NoAction'Matt Anderson (Huntress) · Windows

highPPL Tampering Via WerFaultSecureJason (https://github.com/0xbcf) · Windows

highPUA - CleanWipe ExecutionNasreddine Bencherchali (Nextron Systems) · Windows

highPython Function Execution Security Warning Disabled In Excel@Kostastsale · Windows

highRaccine UninstallFlorian Roth (Nextron Systems) · Windows

highReg Add Suspicious Pathsfrack113, Nasreddine Bencherchali (Nextron Systems) · Windows

highSafeBoot Registry Key Deleted Via Reg.EXENasreddine Bencherchali (Nextron Systems), Tim Shelton · Windows

highSecurity Service Disabled Via Reg.EXEFlorian Roth (Nextron Systems), John Lambert (idea), elhoim · Windows

highService Registry Key Deleted Via Reg.EXENasreddine Bencherchali (Nextron Systems) · Windows

highSuspicious Uninstall of Windows Defender Feature via PowerShellyxinmiracle · Windows

highSuspicious Windows Defender Registry Key Tampering Via Reg.EXEFlorian Roth (Nextron Systems), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems) · Windows

highSuspicious Windows Service TamperingNasreddine Bencherchali (Nextron Systems), frack113 , X__Junior (Nextron Systems) · Windows

highSuspicious Windows Trace ETW Session Tamper Via Logman.EXEFlorian Roth (Nextron Systems) · Windows

highSysinternals PsSuspend Suspicious ExecutionNasreddine Bencherchali (Nextron Systems) · Windows

highSysmon Driver Unloaded Via Fltmc.EXEKirill Kiryanov, oscd.community · Windows

highTamper Windows Defender Remove-MpPreferenceNasreddine Bencherchali (Nextron Systems) · Windows

highTaskkill Symantec Endpoint ProtectionIlya Krestinichev, Florian Roth (Nextron Systems) · Windows

highUninstall Crowdstrike Falcon Sensorfrack113 · Windows

highUninstall Sysinternals Sysmonfrack113 · Windows

highVulnerable Driver Blocklist Registry Tampering Via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

highWindows AMSI Related Registry Tampering Via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

highWindows Credential Guard Registry Tampering Via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

highWindows Defender Context Menu RemovedMatt Anderson (Huntress) · Windows

highWindows Defender Definition Files Removedfrack113 · Windows

highWindows Defender Disabled Via SystemSettingsAdminFlows.EXEChirag Damani (KPMG India), Swachchhanda Shrawan Poudel (Nextron Systems) · Windows

mediumDisable Or Stop ServicesNasreddine Bencherchali (Nextron Systems) · Linux

mediumDisable Security ToolsDaniil Yugoslavskiy, oscd.community · macOS

mediumDism Remove Online Packagefrack113 · Windows

mediumESXi Syslog Configuration Change Via ESXCLICedric Maurugeon · Linux

mediumFilter Driver Unloaded Via Fltmc.EXENasreddine Bencherchali (Nextron Systems) · Windows

mediumPotential AMSI Bypass Using NULL BitsNasreddine Bencherchali (Nextron Systems) · Windows

mediumPotential Suspicious Activity Using SeCEditJanantha Marasinghe · Windows

mediumPowershell Defender ExclusionFlorian Roth (Nextron Systems) · Windows

mediumService Startup Type Change Via Wmic.EXESwachchhanda Shrawan Poudel (Nextron Systems) · Windows

mediumService StartupType Change Via PowerShell Set-ServiceNasreddine Bencherchali (Nextron Systems) · Windows

mediumService StartupType Change Via Sc.EXENasreddine Bencherchali (Nextron Systems) · Windows

mediumSuspicious Windows Defender Folder Exclusion Added Via Reg.EXEfrack113 · Windows

mediumSysmon Configuration UpdateNasreddine Bencherchali (Nextron Systems) · Windows

mediumTerminate Linux Process Via KillTuan Le (NCSGroup) · Linux

mediumWindows Firewall Disabled via PowerShellTim Rauch, Elastic (idea) · Windows

mediumWrite Protect For Storage DisabledSreeman · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Capture a video from the replay buffer on the page for gpu-screen-recorder

pkill -SIGUSR1 -f gpu-screen-recorderIdentify

Terminate a program using the default SIGTERM (terminate) signal on the page for kill

kill process_idIdentify

List available signal names (to be used without the SIG prefix) on the page for kill

kill -lIdentify

Terminate a program using the SIGHUP (hang up) signal. Many daemons will reload instead of terminating on the page for kill

kill -SIGHUP process_idIdentify

Terminate a program using the SIGINT (interrupt) signal. This is typically initiated by the user pressing <Ctrl c> on the page for kill

kill -SIGINT process_idIdentify

Signal the operating system to immediately terminate a program (which gets no chance to capture the signal) on the page for kill

kill -SIGKILL process_idIdentify

Signal the operating system to pause a program until a SIGCONT ("continue") signal is received on the page for kill

kill -SIGSTOP process_idIdentify

Send a SIGUSR1 signal to all processes with the given GID (group id) on the page for kill

kill -SIGUSR1 -group_idIdentify

Terminate a background job on the page for kill

kill %job_idIdentify

Terminate a process using the default SIGTERM (terminate) signal on the page for killall

killall process_nameIdentify

List available signal names (to be used without the SIG prefix) on the page for killall

killall --listIdentify

Interactively ask for confirmation before termination on the page for killall

killall --interactive process_nameIdentify

And 25 more examples on CmdID’s program pages.

An example is here when CmdID’s reading of it names T1685: a Sigma rule it trips is tagged with it, or its abuse is documented as it.