T1685.003 · defense-impairment · ATT&CK 19.1

Modify or Spoof Tool UI

Adversaries may spoof or manipulate security tool user interfaces (UIs) to falsely indicate tools are functioning normally and delay detection and response. Adversaries may present misleading or falsified security tool interfaces (UIs) that display normal or healthy status indicators, even when underlying security tools have been disabled, degraded, or otherwise tampered with. Security tools typically provide visibility into system health, alerting, and operational status; by misrepresenting this information, adversaries can undermine defender trust in these signals and obscure the true security posture of the system. This behavior is often used in conjunction with efforts to disable or modify tools, where adversaries first impair the functionality of defenses (e.g., EDR, logging agents) and then replace or mimic their interfaces to conceal the loss of visibility. By maintaining the appearance of normal operations, such as showing active protection, successful updates, or absence of threats, adversaries can delay investigation and response, enabling continued malicious activity. For example, adversaries may display a fake Windows Security interface or system tray icon indicating a “protected” or “healthy” state after disabling Windows Defender or related services.(Citation: BlackBasta)

Open in the interactive knowledge mesh

Detection overview

Use the published detection strategies below and validate required telemetry in the target environment.

Observed groups

No current Enterprise group relationship is published in this bundle.

Cyber Knowledge context

Use these routes to move from the ATT&CK behavior into explanation, implementation, evidence handling, validation, and defensive operations. Relevance is generated from explicit identifiers/names and governed topic mappings; it is not attribution evidence.

Module 12 — Incident response, DFIR, crisis coordination, and recovery
Blue Team & Defensive Security · topic-match · 57/100Module 13 — AI-assisted defense, RAG, agents, and MCP
Blue Team & Defensive Security · topic-match · 57/100Module 14 — Safe validation, purple teaming, metrics, and maturity
Blue Team & Defensive Security · topic-match · 57/100Module 3 — Telemetry and logging architecture
Blue Team & Defensive Security · topic-match · 54/100Module 1 — Defensive mission, operating model, and SOC service
Blue Team & Defensive Security · topic-match · 45/100Module 4 — Detection engineering and detection as code
Blue Team & Defensive Security · topic-match · 45/100Controlled dynamic behavior and differential observation
Malware Analysis & Reverse Engineering · tactic-route · 24/100Windows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · tactic-route · 24/100

MITRE mitigations

M1038 · Execution Prevention

Prevent the execution of unauthorized or malicious code on systems by implementing application control, script blocking, and other execution prevention mechanisms. This ensures that only trusted and authorized code is executed, reducing the risk of malware and unauthorized actions. This mitigation can be implemented through the following measures: Application Control: - Use Case: Use tools like AppLocker or Windows Defender Application Control (WDAC) to create whitelists of authorized applications and block unauthorized ones. On Linux, use tools like SELinux or AppArmor to define mandatory access control policies for application execution. - Implementation: Allow only digitally signed or pre-approved applications to execute on servers and endpoints. (e.g., `New-AppLockerPolicy -PolicyType Enforced -FilePath "C:\Policies\AppLocker.xml"`) Script Blocking: - Use Case: Use script control me…

MITRE mitigation source

MITRE detection strategies and analytics

DET0311 · Detection for Spoofing Tool UI across OS Platforms
  • AN0868 · Analytic 0868 — Detection of inconsistencies between reported sensor health and actual process/service state. For example, Windows Defender tray icon/UI showing healthy status while corresponding Defender services (WinDefend, MsMpEng) are stopped or disabled. Correlates process creation events with missing or terminated security processes and spoofed health events.
  • AN0869 · Analytic 0869 — Monitoring for discrepancies between system daemon/service state and reported health messages (e.g., syslog shows AV/IDS daemon stopped, but spoofed messages claim it is still running). Detects userland processes impersonating AV/IDS command-line outputs or modifying log forwarding configurations.
  • AN0870 · Analytic 0870 — Detection of fake or spoofed macOS Security & Privacy GUIs showing healthy status after XProtect, Gatekeeper, or AV processes are disabled. Correlates user-space UI process creation with terminated or missing security daemons.
MITRE detection source