T1685Defense Impairment
Disable or Modify Tools
Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
168 Sigma rules tagged T1685Disable or Modify ToolsT1685168 general rules
- RedSun - Named Pipe Createdcriticalexperimental
- RedSun - TieringEngineService.exe Detected as EICAR Test Filecriticalexperimental
- AWS SecurityHub Findings Evasionhighstable
- Microsoft Defender Tamper Protection Triggerhighstable
- Windows Defender Configuration Changeshighstable
- Windows Defender Grace Period Expiredhighstable
- Windows Defender Malware And PUA Scanning Disabledhighstable
- Windows Defender Real-time Protection Disabledhighstable
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Disable or Modify Tools
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.