Disabling or Modifying Security Tools

Overview

Disabling or modifying security tools is a technique used by adversaries to undermine defensive mechanisms within a target environment. This approach facilitates stealth and persistence by reducing the likelihood of detection and response during various stages of an attack lifecycle.

Attack Objective

• Achieve stealth and maintain control by neutralizing security defenses
• Supports multiple stages including Execution, Persistence, Privilege Escalation, Defense Evasion, and Lateral Movement
• Advances the attacker’s position by preventing or delaying detection and enabling continued access

How the Technique Works

Adversaries disable or alter security tools such as antivirus software, endpoint detection and response (EDR) agents, logging services, or network monitoring systems. This can involve stopping or uninstalling services, modifying configurations, tampering with logs, or exploiting vulnerabilities in security software to reduce their effectiveness or visibility.

Common Methods & Variations

• Terminating or disabling security processes and services on endpoints
• Modifying or deleting security logs and alerts to cover tracks
• Altering cloud security configurations or disabling cloud-native protections
• Manipulating identity and access management controls to bypass security policies
• Using living-off-the-land binaries and scripts to avoid introducing new tools
• Deploying custom malware or scripts specifically designed to disable defenses

Indicators of Compromise (IOCs)

• Unexpected termination or failure of security services and agents
• Gaps or anomalies in security logs and audit trails
• Unusual configuration changes in security or monitoring systems
• Alerts for disabled or tampered security controls from centralized management consoles
• Network traffic indicative of command and control activity following security tool disruption

Detection Strategies

• Monitoring endpoint telemetry for process and service stoppages related to security tools
• Correlation of configuration changes and log deletions with suspicious user or process activity
• Behavioral analysis to identify anomalous interactions with security software
• Utilizing centralized logging and alerting to detect gaps or inconsistencies
• Employing heuristic detection to identify living-off-the-land tool misuse

Mitigation & Prevention

• Implementing least privilege principles to restrict modification of security tools
• Enforcing strong access controls and multi-factor authentication for administrative functions
• Hardening security software configurations and enabling tamper protection features
• Maintaining comprehensive and immutable logging with regular integrity checks
• Segmenting networks and employing defense-in-depth to limit attacker movement

Response Considerations

• Immediate containment by isolating affected systems to prevent further tampering
• Conducting thorough investigation to identify scope and method of security tool disruption
• Restoring security tools and configurations from trusted backups
• Applying patches and updates to address exploited vulnerabilities
• Enhancing monitoring and alerting to detect similar attempts in the future

Related Techniques

• Credential Access – to gain permissions required to disable security tools
• Defense Evasion – broader category encompassing this technique
• Persistence – maintaining access after disabling defenses
• Lateral Movement – exploiting disabled security controls to move within the network
• Command and Control – establishing communication channels after neutralizing detection

Mapping & References

• MITRE ATT&CK Tactic: Defense Evasion
• MITRE ATT&CK Technique: T1562 – Impair Defenses
• Public advisories on tampering with endpoint security and logging systems
• Incident reports detailing attacks involving disabling of security tools