Wiki › Techniques, Tactics & Procedures (TTPs) › Defense Evasion › Tampering with Endpoint Protection

Tampering with Endpoint Protection

2 min read

Jump to:

Overview

Tampering with endpoint protection involves adversaries manipulating or disabling security controls on endpoint devices to evade detection and maintain persistence. This technique is commonly employed during various stages of an attack lifecycle to undermine defensive mechanisms and facilitate further malicious activity.

Attack Objective

Bypass or disable endpoint security to achieve stealth and maintain control
Supports multiple stages including Initial Access, Execution, Persistence, Privilege Escalation, and Defense Evasion
Advances attacker position by reducing the likelihood of detection and enabling uninterrupted operations on compromised endpoints

How the Technique Works

Adversaries alter, disable, or interfere with endpoint protection software such as antivirus, endpoint detection and response (EDR), or host intrusion prevention systems (HIPS). This can involve modifying configuration settings, stopping security services, deleting or altering security-related files, or exploiting vulnerabilities to bypass protection mechanisms. The goal is to neutralize defenses that would otherwise detect or block malicious activity.

Common Methods & Variations

Disabling or uninstalling endpoint security agents
Modifying security software configurations or policies
Injecting code to bypass or tamper with security processes
Using legitimate administrative tools or scripts (living-off-the-land) to alter security settings
Targeting on-premises endpoints, cloud-managed endpoint agents, or identity-based protections
Employing custom malware or publicly available tools to evade detection

Indicators of Compromise (IOCs)

Unexpected termination or failure of endpoint protection services
Modification timestamps on security software files or configurations
Unusual process activity related to security agents
Alerts for disabled or outdated endpoint protection components
Logs showing administrative changes to security settings outside normal maintenance windows

Detection Strategies

Monitoring endpoint telemetry including service status, process creation, and file integrity
Behavioral detection focusing on anomalous changes to security software and configurations
Correlation of endpoint events with identity and network activity to identify suspicious patterns
Use of centralized logging and alerting to detect unauthorized modifications

Mitigation & Prevention

Enforce least privilege and restrict administrative access to endpoint security controls
Implement tamper protection features provided by endpoint security solutions
Regularly update and patch endpoint protection software and underlying operating systems
Use configuration management and integrity monitoring to detect unauthorized changes
Employ multi-factor authentication and strong identity controls for administrative accounts

Response Considerations

Immediately isolate affected endpoints to prevent further tampering or lateral movement
Investigate the scope of security control modifications and identify initial access vectors
Restore endpoint protection configurations and verify integrity of security software
Conduct root cause analysis and apply hardening measures to prevent recurrence

Related Techniques

Disabling Security Tools
Credential Access through privilege escalation
Persistence via malicious service or scheduled task creation
Lateral Movement using compromised credentials or remote execution
Defense Evasion through obfuscation or code injection

Mapping & References

MITRE ATT&CK Tactic: Defense Evasion
MITRE ATT&CK Technique: T1562 – Impair Defenses
MITRE ATT&CK Sub-technique: T1562.001 – Disable or Modify Tools
Public advisories and incident reports detailing endpoint protection tampering cases

Tags: Cyber Attack Techniques Defense Evasion endpoint protection endpoint security Incident Response MITRE ATT&CK persistence privilege escalation Security Controls Threat Detection