Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

ChecklistCONSTRUCTEDUntestedMembers

First 15 minutes: endpoint protection was switched off or tampered with

A sensor went quiet, an exclusion appeared, or tamper protection blocked a change. On its own it may be an update. Across several hosts in an hour it is somebody clearing the way, and the gap it leaves is time you cannot see.

critical severityDefense ImpairmentT1685T1489

The clock starts when

EDR reports a sensor going offline unexpectedly, an exclusion being added, a policy being changed, a security service being stopped, or tamper protection blocking any of these.

  1. minutes 0 to 5Find out what changed and who changed it3 lines
  2. minutes 5 to 10Contain3 lines
  3. minutes 10 to 15Reconstruct the blind window3 lines, 1 where evidence expires

sources

  1. MITRE ATT&CK T1685, Disable or Modify Tools · primary
  2. Microsoft Learn: protect security settings with tamper protection
  3. CISA, MS-ISAC, NSA and FBI: #StopRansomware Guide

Tags: first-15 · edr · defense-impairment · tamper-protection · defender · ransomware · T1685