T1685
Disable or Modify Tools
Containers · ESXi · IaaS · Linux · macOS · Network Devices · Windows9 pieces on this siteT1685 on attack.mitre.org
Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Ransomware, suspected or confirmed
Files renamed or unreadable, a ransom note, or backup deletion commands seen.
Detect it
Hunts and rules you can run, each stating what it needs and what else it returns.
Sigma endpoint pack: seven rules for the Windows techniques that keep working
Shadow copy deletion, LSASS dumping through comsvcs, long encoded PowerShell, scheduled tasks and services in user-writable paths, WMI subscriptions and a cleared Security log. Each rule ships with the false positives it was written expecting.
Hunt: the Security audit log was cleared
Event 1102 is the first record of the new log, so it survives the clearing and names the account that did it. One of the cheapest hunts there is, and worth thirty days rather than seven.
The evidence it leaves
Where the traces live, and what each source proves and does not.
Microsoft Defender Antivirus logs
AWS CloudTrail
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
Somebody disabled the antivirus on eleven servers
You have minutes rather than hours. Say what you do first, and what you deliberately do not do.
Read
Analyses, case studies, guides, references and interview questions.
Incident report: Kesterline Components, 8 May 2026
A full DFIR report on a constructed ransomware incident, written the way one gets handed to a board. Three hours twenty from first execution to encryption, four separate points where it could have been stopped, and the write-up that follows.
Forensic timeline cheat sheet: which clock, whose time zone, and what each timestamp really records
A timeline is only as good as your understanding of what each timestamp means. The artifacts that carry time on Windows, what event each one actually records, the zone it is stored in, and the commands to build and cut a super timeline.
Windows event log cheat sheet: by the question you are asking
Organised by what you are trying to establish rather than by number: who logged on and how, what ran, what persisted, what was tampered with. Every entry says which log, whether it is on by default, and what it does not tell you.
how MITRE says to see it
Detection of Defense Impairment through Disabled or Modified Tools across OS Platforms.
- Detection of adversary behavior that disables or modifies security tools, including killing AV/EDR processes, stopping services, altering Sysmon registry keys, or tampering with exclusion lists. Defenders observe process/service termination, registry modification, and abnormal absence of expected telemetry.
- Detects kill/systemctl/service commands against EDR, auditd, falco, osquery, rsyslog, journald, or agent processes; configuration edits disabling startup; module unload attempts; abrupt cessation of logs after privileged shell execution.
- Detection of adversary disabling endpoint security tools by unloading launch agents/daemons, modifying configuration profiles, or disabling Gatekeeper/XProtect/logging settings, or removing endpoint agents followed by telemetry loss.
- Correlates control-plane API actions disabling cloud-native monitoring or sensor agents (CloudTrail, GuardDuty, Security Hub, Defender, monitoring agents), role abuse preceding disablement, or instance agent uninstall events
what reduces it
- M1038 Execution Prevention. Use application control where appropriate, especially regarding the execution of tools outside of the organization's security policies (such as rootkit removal tools) that have been abused to impair system defenses. Ensure that only approved security applications are used and running on enterprise systems.
- M1018 User Account Management. Ensure proper user permissions are in place to prevent adversaries from disabling or interfering with security services.
- M1022 Restrict File and Directory Permissions. Ensure proper process and file permissions are in place to prevent adversaries from disabling or interfering with security services.
- M1024 Restrict Registry Permissions. Ensure proper Registry permissions are in place to prevent adversaries from disabling or interfering with security services.
- M1054 Software Configuration. Consider automatically relaunching forwarding mechanisms at recurring intervals (ex: temporal, on-logon, etc.) as well as applying appropriate change management to firewall rules and other related system configurations.
- M1047 Audit. Periodically verify that tools are functioning appropriately – for example, that all expected hosts with EDRs or monitoring agents are checking in to the central console. Check EDRs to ensure that no unexpected exclusion paths have been added. In Microsoft Defender for Endpoint, exclusions can be reviewed with the `Get-MpPreference` cmdlet.