{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1685","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"71b1c7aa1586b6cc2e56fb7c8f5e23a414052ad5cc643aea87d6c4b61a76a4d7","description":"Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.(Citation: SCADAfence_ransomware) \n\nIn addition to directly targeting tools, adversaries may block or manipulate indicators and telemetry used for detection. This includes maliciously disabling or redirecting sensors such as Event Tracing for Windows (ETW), modifying event log configurations (e.g., redirecting Security logs), or interfering with logging pipelines and forwarding mechanisms (e.g., SIEM ingestion).(Citation: Microsoft Lamin Sept 2017)(Citation: ETW Palantir)\n\nMore advanced techniques include leveraging legitimate drivers or debugging mechanisms to render tools non-functional, bypassing anti-tampering protections, and targeting specific defenses such as Sysmon or cloud monitoring agents. Adversaries may also disrupt broader defensive operations, including update mechanisms, logging infrastructure (e.g., syslog), or event aggregation, further degrading an organization’s ability to detect and respond to malicious activity.(Citation: Cocomazzi FIN7 Reboot)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1685","external_id":"T1685"},{"source_name":"Cocomazzi FIN7 Reboot","description":"Cocomazzi, Antonio. (2024, July 17). FIN7 Reboot | Cybercrime Gang Enhances Ops with New EDR Bypasses and Automated Attacks. Retrieved September 24, 2025.","url":"https://www.sentinelone.com/labs/fin7-reboot-cybercrime-gang-enhances-ops-with-new-edr-bypasses-and-automated-attacks/"},{"source_name":"Microsoft Lamin Sept 2017","description":"Microsoft. (2009, May 17). Backdoor:Win32/Lamin.A. Retrieved September 6, 2018.","url":"https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Backdoor:Win32/Lamin.A"},{"source_name":"ETW Palantir","description":"Palantir. (2018, December 24). Tampering with Windows Event Tracing: Background, Offense, and Defense. Retrieved April 15, 2026.","url":"https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63"},{"source_name":"SCADAfence_ransomware","description":"Shaked, O. (2020, January 20). Anatomy of a Targeted Ransomware Attack. Retrieved June 18, 2022.","url":"https://cdn.logic-control.com/docs/scadafence/Anatomy-Of-A-Targeted-Ransomware-Attack-WP.pdf"}],"platforms":["Containers","ESXi","IaaS","Linux","macOS","Network Devices","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","network-infrastructure","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1685.001","id":"T1685.001","name":"Disable or Modify Windows Event Log","page":"techniques/enterprise/T1685.001/"},{"key":"enterprise/T1685.002","id":"T1685.002","name":"Disable or Modify Cloud Log","page":"techniques/enterprise/T1685.002/"},{"key":"enterprise/T1685.003","id":"T1685.003","name":"Modify or Spoof Tool UI","page":"techniques/enterprise/T1685.003/"},{"key":"enterprise/T1685.004","id":"T1685.004","name":"Disable or Modify Linux Audit System Log","page":"techniques/enterprise/T1685.004/"},{"key":"enterprise/T1685.005","id":"T1685.005","name":"Clear Windows Event Logs","page":"techniques/enterprise/T1685.005/"},{"key":"enterprise/T1685.006","id":"T1685.006","name":"Clear Linux or Mac System Logs","page":"techniques/enterprise/T1685.006/"},{"key":"enterprise/T1685.007","id":"T1685.007","name":"Impair Autonomous Defenses","page":"techniques/enterprise/T1685.007/"}],"telemetry":[{"id":"DC0069","name":"Cloud Service Modification","page":"telemetry/DC0069/","kind":"attack_component","category":"Cloud control plane","description":"Changes to a managed cloud service configuration.","collection_focus":"Collect the service-specific update API and resulting configuration state; record account/project, actor and changed settings.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["service","resource_id","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0069","collector":"illustrative-lab-collector","observation":{"service":"lab-audit-service","resource_id":"lab-service-1","attribute":"retention_days","before":7,"after":30}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."},{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0018","name":"Host Status","page":"telemetry/DC0018/","kind":"attack_component","category":"Host state and inventory","description":"Host health and availability observations such as heartbeat, shutdown or degraded state.","collection_focus":"Collect agent heartbeat and OS health independently; record missed polls, last-seen time and monitor health.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["asset_id","status","heartbeat_age_seconds","collector_healthy"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0018","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-host-1","status":"degraded","heartbeat_age_seconds":90,"collector_healthy":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0033","name":"Process Termination","page":"telemetry/DC0033/","kind":"attack_component","category":"Endpoint activity","description":"Termination of a process, correlated to its earlier creation.","collection_focus":"Collect Sysmon ProcessTerminate (5) and join on ProcessGuid; do not assume every provider records an exit code.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","process_id","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0033","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","process_id":4200,"action":"terminate"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0060","name":"Service Creation","page":"telemetry/DC0060/","kind":"attack_component","category":"Windows and directory audit","description":"Installation or registration of a service.","collection_focus":"Collect service-install auditing through Audit Security System Extension where supported, plus Service Control Manager/System logs and the new service configuration.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["service","action","executable","actor"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0060","collector":"illustrative-lab-collector","observation":{"service":"LabService","action":"install","executable":"C:\\Lab\\service.exe","actor":"lab-admin"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0041","name":"Service Metadata","page":"telemetry/DC0041/","kind":"attack_component","category":"Host state and inventory","description":"Service configuration and current state at observation time.","collection_focus":"Inventory service name, executable, startup mode, owner and status using supported OS APIs; compare successive snapshots.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["service","executable","start_mode","state"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0041","collector":"illustrative-lab-collector","observation":{"service":"LabService","executable":"C:\\Lab\\service.exe","start_mode":"manual","state":"stopped"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0065","name":"Service Modification","page":"telemetry/DC0065/","kind":"attack_component","category":"Windows and directory audit","description":"Changes to a service configuration or startup behavior.","collection_focus":"Collect service manager/configuration audit and snapshot differences, including executable path, service account and start mode.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["service","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0065","collector":"illustrative-lab-collector","observation":{"service":"LabService","attribute":"start_mode","before":"manual","after":"automatic"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0063","name":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component","category":"Endpoint activity","description":"Registry value changes or registry object renames.","collection_focus":"Use RegistryEvent 13 for value-set and 14 for rename; compare against intended policy and keep original type/value where available.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence."],"configuration_example":null,"required_fields":["registry_path","event_type","value_type","value"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","domain":"enterprise","platforms":["Containers","ESXi","IaaS","Linux","macOS","Network Devices","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","network-infrastructure","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1685","technique_page":"techniques/enterprise/T1685/","page":"detections/enterprise/T1685/","status":"rule_source_available","counts":{"sigma":156,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":7,"live_validated":0},"sigma_rules":[{"id":"e16cf0f0-ee88-4901-bd0b-4c8d13d9ee05","title":"Bitbucket Global Secret Scanning Rule Deleted","status":"test","level":"medium","logsource":{"product":"bitbucket","service":"audit","definition":"Requirements: \"Basic\" log level is required to receive these audit events."},"data_path":"data/detection-rules/e16cf0f0-ee88-4901-bd0b-4c8d13d9ee05.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/bitbucket/audit/bitbucket_audit_global_secret_scanning_rule_deleted.yml","author":"Muhammad Faisal (@faisalusuf)","kind":"sigma"},{"id":"16ab6143-510a-44e2-a615-bdb80b8317fc","title":"Bitbucket Global SSH Settings Changed","status":"test","level":"medium","logsource":{"product":"bitbucket","service":"audit","definition":"Requirements: \"Advance\" log level is required to receive these audit events."},"data_path":"data/detection-rules/16ab6143-510a-44e2-a615-bdb80b8317fc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/bitbucket/audit/bitbucket_audit_global_ssh_settings_change_detected.yml","author":"Muhammad Faisal (@faisalusuf)","kind":"sigma"},{"id":"6aa12161-235a-4dfb-9c74-fe08df8d8da1","title":"Bitbucket Audit Log Configuration Updated","status":"test","level":"medium","logsource":{"product":"bitbucket","service":"audit","definition":"Requirements: \"Basic\" log level is required to receive these audit events."},"data_path":"data/detection-rules/6aa12161-235a-4dfb-9c74-fe08df8d8da1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/bitbucket/audit/bitbucket_audit_log_configuration_update_detected.yml","author":"Muhammad Faisal (@faisalusuf)","kind":"sigma"},{"id":"42ccce6d-7bd3-4930-95cd-e4d83fa94a30","title":"Bitbucket Project Secret Scanning Allowlist Added","status":"test","level":"low","logsource":{"product":"bitbucket","service":"audit","definition":"Requirements: \"Basic\" log level is required to receive these audit events."},"data_path":"data/detection-rules/42ccce6d-7bd3-4930-95cd-e4d83fa94a30.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/bitbucket/audit/bitbucket_audit_project_secret_scanning_allowlist_added.yml","author":"Muhammad Faisal (@faisalusuf)","kind":"sigma"},{"id":"b91e8d5e-0033-44fe-973f-b730316f23a1","title":"Bitbucket Secret Scanning Exempt Repository Added","status":"test","level":"high","logsource":{"product":"bitbucket","service":"audit","definition":"Requirements: \"Basic\" log level is required to receive these audit events."},"data_path":"data/detection-rules/b91e8d5e-0033-44fe-973f-b730316f23a1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/bitbucket/audit/bitbucket_audit_secret_scanning_exempt_repository_detected.yml","author":"Muhammad Faisal (@faisalusuf)","kind":"sigma"},{"id":"ff91e3f0-ad15-459f-9a85-1556390c138d","title":"Bitbucket Secret Scanning Rule Deleted","status":"test","level":"low","logsource":{"product":"bitbucket","service":"audit","definition":"Requirements: \"Basic\" log level is required to receive these audit events."},"data_path":"data/detection-rules/ff91e3f0-ad15-459f-9a85-1556390c138d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/bitbucket/audit/bitbucket_audit_secret_scanning_rule_deleted.yml","author":"Muhammad Faisal (@faisalusuf)","kind":"sigma"},{"id":"02cf536a-cf21-4876-8842-4159c8aee3cc","title":"Github Push Protection Bypass Detected","status":"test","level":"low","logsource":{"product":"github","service":"audit","definition":"Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"},"data_path":"data/detection-rules/02cf536a-cf21-4876-8842-4159c8aee3cc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/github/audit/github_push_protection_bypass_detected.yml","author":"Muhammad Faisal (@faisalusuf)","kind":"sigma"},{"id":"ccd55945-badd-4bae-936b-823a735d37dd","title":"Github Push Protection Disabled","status":"test","level":"high","logsource":{"product":"github","service":"audit","definition":"Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"},"data_path":"data/detection-rules/ccd55945-badd-4bae-936b-823a735d37dd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/github/audit/github_push_protection_disabled.yml","author":"Muhammad Faisal (@faisalusuf)","kind":"sigma"},{"id":"3883d9a0-fd0f-440f-afbb-445a2a799bb8","title":"Github Secret Scanning Feature Disabled","status":"test","level":"high","logsource":{"product":"github","service":"audit","definition":"Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"},"data_path":"data/detection-rules/3883d9a0-fd0f-440f-afbb-445a2a799bb8.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/github/audit/github_secret_scanning_feature_disabled.yml","author":"Muhammad Faisal (@faisalusuf)","kind":"sigma"},{"id":"d2656e78-c069-4571-8220-9e0ab5913f19","title":"AWS GuardDuty Detector Deleted Or Updated","status":"experimental","level":"high","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/d2656e78-c069-4571-8220-9e0ab5913f19.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_cloudtrail_guardduty_detector_deleted_or_updated.yml","author":"suktech24","kind":"sigma"},{"id":"6e61ee20-ce00-4f8d-8aee-bedd8216f7e3","title":"AWS GuardDuty Important Change","status":"test","level":"high","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/6e61ee20-ce00-4f8d-8aee-bedd8216f7e3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_guardduty_disruption.yml","author":"faloker","kind":"sigma"},{"id":"a607e1fe-74bf-4440-a3ec-b059b9103157","title":"AWS SecurityHub Findings Evasion","status":"stable","level":"high","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/a607e1fe-74bf-4440-a3ec-b059b9103157.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_securityhub_finding_evasion.yml","author":"Sittikorn S","kind":"sigma"},{"id":"225d8b09-e714-479c-a0e4-55e6f29adf35","title":"Azure Kubernetes Events Deleted","status":"test","level":"medium","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/225d8b09-e714-479c-a0e4-55e6f29adf35.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_kubernetes_events_deleted.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"fe513c69-734c-4d4a-8548-ac5f609be82b","title":"Google Cloud Firewall Modified or Deleted","status":"test","level":"medium","logsource":{"product":"gcp","service":"gcp.audit"},"data_path":"data/detection-rules/fe513c69-734c-4d4a-8548-ac5f609be82b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/gcp/audit/gcp_firewall_rule_modified_or_deleted.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"bde30855-5c53-4c18-ae90-1ff79ebc9578","title":"Okta User Session Start Via An Anonymising Proxy Service","status":"test","level":"high","logsource":{"product":"okta","service":"okta"},"data_path":"data/detection-rules/bde30855-5c53-4c18-ae90-1ff79ebc9578.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/identity/okta/okta_user_session_start_via_anonymised_proxy.yml","author":"kelnage","kind":"sigma"},{"id":"e497a24e-9345-4a62-9803-b06d7d7cb132","title":"ASLR Disabled Via Sysctl or Direct Syscall - Linux","status":"experimental","level":"high","logsource":{"product":"linux","service":"auditd"},"data_path":"data/detection-rules/e497a24e-9345-4a62-9803-b06d7d7cb132.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/lnx_auditd_disable_aslr_protection.yml","author":"Milad Cheraghi","kind":"sigma"},{"id":"977ef627-4539-4875-adf4-ed8f780c4922","title":"Auditing Configuration Changes on Linux Host","status":"test","level":"high","logsource":{"product":"linux","service":"auditd"},"data_path":"data/detection-rules/977ef627-4539-4875-adf4-ed8f780c4922.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/path/lnx_auditd_auditing_config_change.yml","author":"Mikhail Larin, oscd.community","kind":"sigma"},{"id":"c830f15d-6f6e-430f-8074-6f73d6807841","title":"Logging Configuration Changes on Linux Host","status":"test","level":"high","logsource":{"product":"linux","service":"auditd"},"data_path":"data/detection-rules/c830f15d-6f6e-430f-8074-6f73d6807841.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/path/lnx_auditd_logging_config_change.yml","author":"Mikhail Larin, oscd.community","kind":"sigma"},{"id":"36388120-b3f1-4ce9-b50b-280d9a7f4c04","title":"Kaspersky Endpoint Security Stopped Via CommandLine - Linux","status":"experimental","level":"high","logsource":{"product":"linux","category":"process_creation"},"data_path":"data/detection-rules/36388120-b3f1-4ce9-b50b-280d9a7f4c04.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_av_kaspersky_av_disabled.yml","author":"Milad Cheraghi","kind":"sigma"},{"id":"38eb1dbb-011f-40b1-a126-cf03a0210563","title":"ESXi Syslog Configuration Change Via ESXCLI","status":"test","level":"medium","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/38eb1dbb-011f-40b1-a126-cf03a0210563.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_esxcli_syslog_config_change.yml","author":"Cedric Maurugeon","kind":"sigma"},{"id":"de25eeb8-3655-4643-ac3a-b662d3f26b6b","title":"Disable Or Stop Services","status":"test","level":"medium","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/de25eeb8-3655-4643-ac3a-b662d3f26b6b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_services_stop_and_disable.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"ff39f1a6-84ac-476f-a1af-37fcdf53d7c0","title":"Disable Security Tools","status":"test","level":"medium","logsource":{"category":"process_creation","product":"macos"},"data_path":"data/detection-rules/ff39f1a6-84ac-476f-a1af-37fcdf53d7c0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_disable_security_tools.yml","author":"Daniil Yugoslavskiy, oscd.community","kind":"sigma"},{"id":"9e8f6035-88bf-4a63-96b6-b17c0508257e","title":"Cisco Disabling Logging","status":"test","level":"high","logsource":{"product":"cisco","service":"aaa"},"data_path":"data/detection-rules/9e8f6035-88bf-4a63-96b6-b17c0508257e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/cisco/aaa/cisco_cli_disable_logging.yml","author":"Austin Clark","kind":"sigma"},{"id":"ef0ff092-a24a-4fbc-beea-06c08d53e085","title":"Cisco Dot1x Disabled","status":"experimental","level":"medium","logsource":{"product":"cisco","service":"aaa"},"data_path":"data/detection-rules/ef0ff092-a24a-4fbc-beea-06c08d53e085.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/cisco/aaa/cisco_cli_dot1x_disabled.yml","author":"Luc Génaux","kind":"sigma"},{"id":"5c8d7b41-3812-432f-a0bb-4cfb7c31827e","title":"FortiGate - Firewall Address Object Added","status":"experimental","level":"medium","logsource":{"product":"fortigate","service":"event"},"data_path":"data/detection-rules/5c8d7b41-3812-432f-a0bb-4cfb7c31827e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/fortinet/fortigate/fortinet_fortigate_new_firewall_address_object.yml","author":"Marco Pedrinazzi @pedrinazziM (InTheCyber)","kind":"sigma"},{"id":"f24ab7a8-f09a-4319-82c1-915586aa642b","title":"FortiGate - New Firewall Policy Added","status":"experimental","level":"medium","logsource":{"product":"fortigate","service":"event"},"data_path":"data/detection-rules/f24ab7a8-f09a-4319-82c1-915586aa642b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/fortinet/fortigate/fortinet_fortigate_new_firewall_policy_added.yml","author":"Marco Pedrinazzi @pedrinazziM (InTheCyber)","kind":"sigma"},{"id":"545a5da6-f103-4919-a519-e9aec1026ee4","title":"Microsoft Malware Protection Engine Crash","status":"test","level":"high","logsource":{"product":"windows","service":"application"},"data_path":"data/detection-rules/545a5da6-f103-4919-a519-e9aec1026ee4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/application/application_error/win_application_error_msmpeng_crash.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"6c82cf5c-090d-4d57-9188-533577631108","title":"Microsoft Malware Protection Engine Crash - WER","status":"test","level":"high","logsource":{"product":"windows","service":"application"},"data_path":"data/detection-rules/6c82cf5c-090d-4d57-9188-533577631108.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/application/windows_error_reporting/win_application_msmpeng_crash_wer.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"bacf58c6-e199-4040-a94f-95dea0f1e45a","title":"Windows Filtering Platform Blocked Connection From EDR Agent Binary","status":"test","level":"high","logsource":{"product":"windows","service":"security","definition":"Requirements: Audit Filtering Platform Connection needs to be enabled"},"data_path":"data/detection-rules/bacf58c6-e199-4040-a94f-95dea0f1e45a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/object_access/win_security_wfp_endpoint_agent_blocked.yml","author":"@gott_cyber","kind":"sigma"},{"id":"f6de9536-0441-4b3f-a646-f4e00f300ffd","title":"Weak Encryption Enabled and Kerberoast","status":"test","level":"high","logsource":{"product":"windows","service":"security","definition":"Requirements: Audit Policy : Account Management > Audit User Account Management, Group Policy : Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Account Management\\Audit User Account Management"},"data_path":"data/detection-rules/f6de9536-0441-4b3f-a646-f4e00f300ffd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_alert_enable_weak_encryption.yml","author":"@neu5ron","kind":"sigma"},{"id":"a4c90ea1-2634-4ca0-adbb-35eae169b6fc","title":"ETW Logging Disabled In .NET Processes - Registry","status":"test","level":"high","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/a4c90ea1-2634-4ca0-adbb-35eae169b6fc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_dot_net_etw_tamper.yml","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","kind":"sigma"},{"id":"98054878-5eab-434c-85d4-72d4e5a3361b","title":"HackTool - EDRSilencer Execution - Filter Added","status":"test","level":"high","logsource":{"product":"windows","service":"security","definition":"Requirements: Audit Filtering Platform Policy Change needs to be enabled"},"data_path":"data/detection-rules/98054878-5eab-434c-85d4-72d4e5a3361b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_hktl_edr_silencer.yml","author":"Thodoris Polyzos (@SmoothDeploy)","kind":"sigma"},{"id":"d3abac66-f11c-4ed0-8acb-50cc29c97eed","title":"NetNTLM Downgrade Attack","status":"test","level":"high","logsource":{"product":"windows","service":"security","definition":"Requirements: Audit Policy : Object Access > Audit Registry (Success)"},"data_path":"data/detection-rules/d3abac66-f11c-4ed0-8acb-50cc29c97eed.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_net_ntlm_downgrade.yml","author":"Florian Roth (Nextron Systems), wagga","kind":"sigma"},{"id":"f63508a0-c809-4435-b3be-ed819394d612","title":"Potential Privileged System Service Operation - SeLoadDriverPrivilege","status":"test","level":"medium","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/f63508a0-c809-4435-b3be-ed819394d612.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_user_driver_loaded.yml","author":"xknow (@xknow_infosec), xorxes (@xor_xes)","kind":"sigma"},{"id":"46a68649-f218-4f86-aea1-16a759d81820","title":"Windows Defender Exclusion List Modified","status":"test","level":"medium","logsource":{"product":"windows","service":"security","definition":"Requirements: Audit Policy : Security Settings/Local Policies/Audit Policy, Registry System Access Control (SACL): Auditing/User"},"data_path":"data/detection-rules/46a68649-f218-4f86-aea1-16a759d81820.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_windows_defender_exclusions_registry_modified.yml","author":"@BarryShooshooga","kind":"sigma"},{"id":"e9c8808f-4cfb-4ba9-97d4-e5f3beaa244d","title":"Windows Defender Exclusion Registry Key - Write Access Requested","status":"test","level":"medium","logsource":{"product":"windows","service":"security","definition":"Requirements: Audit Policy : Security Settings/Local Policies/Audit Policy, Registry System Access Control (SACL): Auditing/User"},"data_path":"data/detection-rules/e9c8808f-4cfb-4ba9-97d4-e5f3beaa244d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_windows_defender_exclusions_write_access.yml","author":"@BarryShooshooga, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"4d7f1827-1637-4def-8d8a-fd254f9454df","title":"Sysmon Application Crashed","status":"test","level":"high","logsource":{"product":"windows","service":"system"},"data_path":"data/detection-rules/4d7f1827-1637-4def-8d8a-fd254f9454df.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/system/application_popup/win_system_application_sysmon_crash.yml","author":"Tim Shelton","kind":"sigma"},{"id":"6c0a7755-6d31-44fa-80e1-133e57752680","title":"Windows Defender Threat Detection Service Disabled","status":"stable","level":"medium","logsource":{"product":"windows","service":"system"},"data_path":"data/detection-rules/6c0a7755-6d31-44fa-80e1-133e57752680.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/system/service_control_manager/win_system_defender_disabled.yml","author":"Ján Trenčanský, frack113","kind":"sigma"},{"id":"360a1340-398a-46b6-8d06-99b905dc69d2","title":"Windows Defender Grace Period Expired","status":"stable","level":"high","logsource":{"product":"windows","service":"windefend"},"data_path":"data/detection-rules/360a1340-398a-46b6-8d06-99b905dc69d2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/windefend/win_defender_antimalware_platform_expired.yml","author":"Ján Trenčanský, frack113","kind":"sigma"},{"id":"1321dc4e-a1fe-481d-a016-52c45f0c8b4f","title":"Windows Defender Exclusions Added","status":"stable","level":"medium","logsource":{"product":"windows","service":"windefend"},"data_path":"data/detection-rules/1321dc4e-a1fe-481d-a016-52c45f0c8b4f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/windefend/win_defender_config_change_exclusion_added.yml","author":"Christian Burkard (Nextron Systems)","kind":"sigma"},{"id":"a3ab73f1-bd46-4319-8f06-4b20d0617886","title":"Windows Defender Exploit Guard Tamper","status":"test","level":"high","logsource":{"product":"windows","service":"windefend"},"data_path":"data/detection-rules/a3ab73f1-bd46-4319-8f06-4b20d0617886.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/windefend/win_defender_config_change_exploit_guard_tamper.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"91903aba-1088-42ee-b680-d6d94fe002b0","title":"Windows Defender Submit Sample Feature Disabled","status":"stable","level":"low","logsource":{"product":"windows","service":"windefend"},"data_path":"data/detection-rules/91903aba-1088-42ee-b680-d6d94fe002b0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/windefend/win_defender_config_change_sample_submission_consent.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"bc275be9-0bec-4d77-8c8f-281a2df6710f","title":"Windows Defender Malware And PUA Scanning Disabled","status":"stable","level":"high","logsource":{"product":"windows","service":"windefend"},"data_path":"data/detection-rules/bc275be9-0bec-4d77-8c8f-281a2df6710f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/windefend/win_defender_malware_and_pua_scan_disabled.yml","author":"Ján Trenčanský, frack113","kind":"sigma"},{"id":"b28e58e4-2a72-4fae-bdee-0fbe904db642","title":"Windows Defender Real-time Protection Disabled","status":"stable","level":"high","logsource":{"product":"windows","service":"windefend"},"data_path":"data/detection-rules/b28e58e4-2a72-4fae-bdee-0fbe904db642.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/windefend/win_defender_real_time_protection_disabled.yml","author":"Ján Trenčanský, frack113","kind":"sigma"},{"id":"dd80db93-6ec2-4f4c-a017-ad40da6ffe81","title":"Windows Defender Real-Time Protection Failure/Restart","status":"stable","level":"medium","logsource":{"product":"windows","service":"windefend"},"data_path":"data/detection-rules/dd80db93-6ec2-4f4c-a017-ad40da6ffe81.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/windefend/win_defender_real_time_protection_errors.yml","author":"Nasreddine Bencherchali (Nextron Systems), Christopher Peacock '@securepeacock' (Update)","kind":"sigma"},{"id":"bc92ca75-cd42-4d61-9a37-9d5aa259c88b","title":"Win Defender Restored Quarantine File","status":"test","level":"high","logsource":{"product":"windows","service":"windefend"},"data_path":"data/detection-rules/bc92ca75-cd42-4d61-9a37-9d5aa259c88b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/windefend/win_defender_restored_quarantine_file.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"801bd44f-ceed-4eb6-887c-11544633c0aa","title":"Windows Defender Configuration Changes","status":"stable","level":"high","logsource":{"product":"windows","service":"windefend"},"data_path":"data/detection-rules/801bd44f-ceed-4eb6-887c-11544633c0aa.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/windefend/win_defender_suspicious_features_tampering.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"49e5bc24-8b86-49f1-b743-535f332c2856","title":"Microsoft Defender Tamper Protection Trigger","status":"stable","level":"high","logsource":{"product":"windows","service":"windefend"},"data_path":"data/detection-rules/49e5bc24-8b86-49f1-b743-535f332c2856.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/windefend/win_defender_tamper_protection_trigger.yml","author":"Bhabesh Raj, Nasreddine Bencherchali","kind":"sigma"},{"id":"686c0b4b-9dd3-4847-9077-d6c1bbe36fcb","title":"Windows Defender Virus Scanning Feature Disabled","status":"stable","level":"high","logsource":{"product":"windows","service":"windefend"},"data_path":"data/detection-rules/686c0b4b-9dd3-4847-9077-d6c1bbe36fcb.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/windefend/win_defender_virus_scan_disabled.yml","author":"Ján Trenčanský, frack113","kind":"sigma"},{"id":"3da70954-0f2c-4103-adff-b7440368f50e","title":"Suspicious PROCEXP152.sys File Created In TMP","status":"test","level":"medium","logsource":{"product":"windows","category":"file_event"},"data_path":"data/detection-rules/3da70954-0f2c-4103-adff-b7440368f50e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_susp_procexplorer_driver_created_in_tmp_folder.yml","author":"xknow (@xknow_infosec), xorxes (@xor_xes)","kind":"sigma"},{"id":"b48492dc-c5ef-4572-8dff-32bc241c15c8","title":"Load Of RstrtMgr.DLL By A Suspicious Process","status":"test","level":"high","logsource":{"category":"image_load","product":"windows"},"data_path":"data/detection-rules/b48492dc-c5ef-4572-8dff-32bc241c15c8.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_dll_rstrtmgr_suspicious_load.yml","author":"Luc Génaux","kind":"sigma"},{"id":"3669afd2-9891-4534-a626-e5cf03810a61","title":"Load Of RstrtMgr.DLL By An Uncommon Process","status":"test","level":"low","logsource":{"category":"image_load","product":"windows"},"data_path":"data/detection-rules/3669afd2-9891-4534-a626-e5cf03810a61.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_dll_rstrtmgr_uncommon_load.yml","author":"Luc Génaux","kind":"sigma"},{"id":"416bc4a2-7217-4519-8dc7-c3271817f1d5","title":"Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location","status":"experimental","level":"high","logsource":{"category":"image_load","product":"windows"},"data_path":"data/detection-rules/416bc4a2-7217-4519-8dc7-c3271817f1d5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_win_susp_dbgcore_dbghelp_load.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"ec19ebab-72dc-40e1-9728-4c0b805d722c","title":"Tamper Windows Defender - PSClassic","status":"test","level":"high","logsource":{"product":"windows","category":"ps_classic_provider_start"},"data_path":"data/detection-rules/ec19ebab-72dc-40e1-9728-4c0b805d722c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_classic/posh_pc_tamper_windows_defender_set_mp.yml","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"e0d6c087-2d1c-47fd-8799-3904103c5a98","title":"AMSI Bypass Pattern Assembly GetType","status":"test","level":"high","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/e0d6c087-2d1c-47fd-8799-3904103c5a98.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_amsi_bypass_pattern_nov22.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"fa2559c8-1197-471d-9cdd-05a0273d4522","title":"Potential AMSI Bypass Script Using NULL Bits","status":"test","level":"medium","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/fa2559c8-1197-471d-9cdd-05a0273d4522.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_amsi_null_bits_bypass.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"99c4658d-2c5e-4d87-828d-7c066ca537c3","title":"Disable-WindowsOptionalFeature Command PowerShell","status":"test","level":"high","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/99c4658d-2c5e-4d87-828d-7c066ca537c3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_disable_windows_optional_feature.yml","author":"frack113","kind":"sigma"},{"id":"115fdba9-f017-42e6-84cf-d5573bf2ddf8","title":"Disable of ETW Trace - Powershell","status":"test","level":"high","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/115fdba9-f017-42e6-84cf-d5573bf2ddf8.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_etw_trace_evasion.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"ae2bdd58-0681-48ac-be7f-58ab4e593458","title":"Tamper Windows Defender Remove-MpPreference - ScriptBlockLogging","status":"test","level":"high","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/ae2bdd58-0681-48ac-be7f-58ab4e593458.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_tamper_windows_defender_rem_mp.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"14c71865-6cd3-44ae-adaa-1db923fae5f2","title":"Tamper Windows Defender - ScriptBlockLogging","status":"test","level":"high","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/14c71865-6cd3-44ae-adaa-1db923fae5f2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_tamper_windows_defender_set_mp.yml","author":"frack113, elhoim, Tim Shelton (fps, alias support), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"c1344fa2-323b-4d2e-9176-84b4d4821c88","title":"Windows Defender Exclusions Added - PowerShell","status":"test","level":"medium","logsource":{"category":"ps_script","product":"windows","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/c1344fa2-323b-4d2e-9176-84b4d4821c88.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_win_defender_exclusions_added.yml","author":"Tim Rauch, Elastic (idea)","kind":"sigma"},{"id":"09706624-b7f6-455d-9d02-adee024cee1d","title":"HackTool - CobaltStrike BOF Injection Pattern","status":"test","level":"high","logsource":{"category":"process_access","product":"windows"},"data_path":"data/detection-rules/09706624-b7f6-455d-9d02-adee024cee1d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_access/proc_access_win_hktl_cobaltstrike_bof_injection_pattern.yml","author":"Christian Burkard (Nextron Systems)","kind":"sigma"},{"id":"9f5c1d59-33be-4e60-bcab-85d2f566effd","title":"Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs","status":"experimental","level":"high","logsource":{"category":"process_access","product":"windows"},"data_path":"data/detection-rules/9f5c1d59-33be-4e60-bcab-85d2f566effd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_access/proc_access_win_susp_dbgcore_dbghelp_load.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"387df17d-3b04-448f-8669-9e7fd5e5fd8c","title":"Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze","status":"experimental","level":"high","logsource":{"category":"process_access","product":"windows","definition":"Requires Sysmon Event ID 10 (ProcessAccess) with CallTrace enabled.\nExample sysmon config snippet with grouping, as logging individual ProcessAccess events can generate excessive logs:\n<ProcessAccess onmatch=\"include\">\n    <Rule groupRelation=\"and\">\n    <TargetImage condition=\"end with\">\\MsMpEng.exe</TargetImage>\n    <SourceImage condition=\"end with\">\\WerFaultSecure.exe</SourceImage>\n    </Rule>\n</ProcessAccess>\n"},"data_path":"data/detection-rules/387df17d-3b04-448f-8669-9e7fd5e5fd8c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_access/proc_access_win_werfaultsecure_msmpeng_access.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"7dbbcac2-57a0-45ac-b306-ff30a8bd2981","title":"Windows AMSI Related Registry Tampering Via CommandLine","status":"experimental","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/7dbbcac2-57a0-45ac-b306-ff30a8bd2981.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_amsi_registry_tampering.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"c17d47b7-dcd6-4109-87eb-d1817bd4cbc9","title":"Windows Credential Guard Registry Tampering Via CommandLine","status":"experimental","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/c17d47b7-dcd6-4109-87eb-d1817bd4cbc9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_credential_guard_registry_tampering.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"1e8a9b4d-3c2a-4f9b-8d1e-7c6a5b4f3d2e","title":"PowerShell Defender Threat Severity Default Action Set to 'Allow' or 'NoAction'","status":"experimental","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/1e8a9b4d-3c2a-4f9b-8d1e-7c6a5b4f3d2e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_defender_default_action_modified.yml","author":"Matt Anderson (Huntress)","kind":"sigma"},{"id":"b9e8c7d6-a5f4-4e3d-8b1a-9f0c8d7e6a5b","title":"Windows Defender Context Menu Removed","status":"experimental","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/b9e8c7d6-a5f4-4e3d-8b1a-9f0c8d7e6a5b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_defender_remove_context_menu.yml","author":"Matt Anderson (Huntress)","kind":"sigma"},{"id":"85f520e7-6f5e-43ca-874c-222e5bf9c0de","title":"Devcon Execution Disabling VMware VMCI Device","status":"experimental","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/85f520e7-6f5e-43ca-874c-222e5bf9c0de.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_devcon_disable_vmci_driver.yml","author":"Matt Anderson, Dray Agha, Anna Pham (Huntress)","kind":"sigma"},{"id":"43e32da2-fdd0-4156-90de-50dfd62636f9","title":"Dism Remove Online Package","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/43e32da2-fdd0-4156-90de-50dfd62636f9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_dism_remove.yml","author":"frack113","kind":"sigma"},{"id":"4931188c-178e-4ee7-a348-39e8a7a56821","title":"Filter Driver Unloaded Via Fltmc.EXE","status":"test","level":"medium","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/4931188c-178e-4ee7-a348-39e8a7a56821.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_fltmc_unload_driver.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"4d7cda18-1b12-4e52-b45c-d28653210df8","title":"Sysmon Driver Unloaded Via Fltmc.EXE","status":"test","level":"high","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/4d7cda18-1b12-4e52-b45c-d28653210df8.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_fltmc_unload_driver_sysmon.yml","author":"Kirill Kiryanov, oscd.community","kind":"sigma"},{"id":"c598cc0c-9e70-4852-b9eb-8921af79f598","title":"Hacktool - EDR-Freeze Execution","status":"experimental","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/c598cc0c-9e70-4852-b9eb-8921af79f598.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_edr_freeze.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"eb2d07d4-49cb-4523-801a-da002df36602","title":"HackTool - EDRSilencer Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/eb2d07d4-49cb-4523-801a-da002df36602.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_edrsilencer.yml","author":"@gott_cyber","kind":"sigma"},{"id":"a34f79a3-8e5f-4cc3-b765-de00695452c2","title":"HackTool - PowerTool Execution","status":"test","level":"high","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/a34f79a3-8e5f-4cc3-b765-de00695452c2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_powertool.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"7a4d9232-92fc-404d-8ce1-4c92e7caf539","title":"HackTool - Stracciatella Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/7a4d9232-92fc-404d-8ce1-4c92e7caf539.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_stracciatella_execution.yml","author":"pH-T (Nextron Systems)","kind":"sigma"},{"id":"6225c53a-a96e-4235-b28f-8d7997cd96eb","title":"Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine","status":"experimental","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/6225c53a-a96e-4235-b28f-8d7997cd96eb.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hvci_registry_tampering.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"cd1f961e-0b96-436b-b7c6-38da4583ec00","title":"Suspicious Windows Trace ETW Session Tamper Via Logman.EXE","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/cd1f961e-0b96-436b-b7c6-38da4583ec00.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_logman_disable_eventlog.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"9719a8aa-401c-41af-8108-ced7ec9cd75c","title":"Windows Defender Definition Files Removed","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/9719a8aa-401c-41af-8108-ced7ec9cd75c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_mpcmdrun_remove_windows_defender_definition.yml","author":"frack113","kind":"sigma"},{"id":"30edb182-aa75-42c0-b0a9-e998bb29067c","title":"Potential AMSI Bypass Via .NET Reflection","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/30edb182-aa75-42c0-b0a9-e998bb29067c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_amsi_init_failed_bypass.yml","author":"Markus Neis, @Kostastsale","kind":"sigma"},{"id":"92a974db-ab84-457f-9ec0-55db83d7a825","title":"Potential AMSI Bypass Using NULL Bits","status":"test","level":"medium","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/92a974db-ab84-457f-9ec0-55db83d7a825.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_amsi_null_bits_bypass.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"c6fb44c6-71f5-49e6-9462-1425d328aee3","title":"Powershell Base64 Encoded MpPreference Cmdlet","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/c6fb44c6-71f5-49e6-9462-1425d328aee3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_base64_mppreference.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"1ec65a5f-9473-4f12-97da-622044d6df21","title":"Powershell Defender Disable Scan Feature","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/1ec65a5f-9473-4f12-97da-622044d6df21.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_defender_disable_feature.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"17769c90-230e-488b-a463-e05c08e9d48f","title":"Powershell Defender Exclusion","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/17769c90-230e-488b-a463-e05c08e9d48f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_defender_exclusion.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"a7ee1722-c3c5-aeff-3212-c777e4733217","title":"Disable Windows Defender AV Security Monitoring","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/a7ee1722-c3c5-aeff-3212-c777e4733217.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_disable_defender_av_security_monitoring.yml","author":"ok @securonix invrep-de, oscd.community, frack113","kind":"sigma"},{"id":"12f6b752-042d-483e-bf9c-915a6d06ad75","title":"Windows Firewall Disabled via PowerShell","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/12f6b752-042d-483e-bf9c-915a6d06ad75.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_disable_firewall.yml","author":"Tim Rauch, Elastic (idea)","kind":"sigma"},{"id":"fb50eb7a-5ab1-43ae-bcc9-091818cb8424","title":"Disabled IE Security Features","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/fb50eb7a-5ab1-43ae-bcc9-091818cb8424.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_disable_ie_features.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"44e24481-6202-4c62-9127-5a0ae8e3fe3d","title":"Obfuscated PowerShell OneLiner Execution","status":"test","level":"high","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/44e24481-6202-4c62-9127-5a0ae8e3fe3d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_download_cradle_obfuscated.yml","author":"@Kostastsale, TheDFIRReport","kind":"sigma"},{"id":"07e3cb2c-0608-410d-be4b-1511cb1a0448","title":"Tamper Windows Defender Remove-MpPreference","status":"test","level":"high","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/07e3cb2c-0608-410d-be4b-1511cb1a0448.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_remove_mppreference.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"62b20d44-1546-4e61-afce-8e175eb9473c","title":"Service StartupType Change Via PowerShell Set-Service","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/62b20d44-1546-4e61-afce-8e175eb9473c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_set_service_disabled.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"c443012c-7928-43bf-ac20-7eda5efe61ad","title":"Suspicious Uninstall of Windows Defender Feature via PowerShell","status":"experimental","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/c443012c-7928-43bf-ac20-7eda5efe61ad.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_uninstall_defender_feature.yml","author":"yxinmiracle","kind":"sigma"},{"id":"f44800ac-38ec-471f-936e-3fa7d9c53100","title":"PUA - CleanWipe Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/f44800ac-38ec-471f-936e-3fa7d9c53100.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_cleanwipe.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"d7662ff6-9e97-4596-a61d-9839e32dee8d","title":"Add SafeBoot Keys Via Reg Utility","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/d7662ff6-9e97-4596-a61d-9839e32dee8d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_add_safeboot.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"48917adc-a28e-4f5d-b729-11e75da8941f","title":"Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/48917adc-a28e-4f5d-b729-11e75da8941f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_defender_exclusion.yml","author":"frack113","kind":"sigma"},{"id":"fc0e89b5-adb0-43c1-b749-c12a10ec37de","title":"SafeBoot Registry Key Deleted Via Reg.EXE","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/fc0e89b5-adb0-43c1-b749-c12a10ec37de.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_delete_safeboot.yml","author":"Nasreddine Bencherchali (Nextron Systems), Tim Shelton","kind":"sigma"},{"id":"05b2aa93-1210-42c8-8d9a-2fcc13b284f5","title":"Service Registry Key Deleted Via Reg.EXE","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/05b2aa93-1210-42c8-8d9a-2fcc13b284f5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_delete_services.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"a1b2c3d4-e5f6-a7b8-c9d0-e1f2a3b4c5d6","title":"Disabling Windows Defender WMI Autologger Session via Reg.exe","status":"experimental","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/a1b2c3d4-e5f6-a7b8-c9d0-e1f2a3b4c5d6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_disable_defender_wmi_autologger.yml","author":"Matt Anderson (Huntress)","kind":"sigma"},{"id":"5e95028c-5229-4214-afae-d653d573d0ec","title":"Security Service Disabled Via Reg.EXE","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/5e95028c-5229-4214-afae-d653d573d0ec.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_disable_sec_services.yml","author":"Florian Roth (Nextron Systems), John Lambert (idea), elhoim","kind":"sigma"},{"id":"b7e2a8d4-74bb-4b78-adc9-3f92af2d4829","title":"Reg Add Suspicious Paths","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/b7e2a8d4-74bb-4b78-adc9-3f92af2d4829.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_susp_paths.yml","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"dee4af55-1f22-4e1d-a9d2-4bdc7ecb472a","title":"Disabled Volume Snapshots","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/dee4af55-1f22-4e1d-a9d2-4bdc7ecb472a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_volsnap_disable.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"452bce90-6fb0-43cc-97a5-affc283139b3","title":"Suspicious Windows Defender Registry Key Tampering Via Reg.EXE","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/452bce90-6fb0-43cc-97a5-affc283139b3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_windows_defender_tamper.yml","author":"Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"75f7a0e2-7154-4c4d-9eae-5cdb4e0a5c13","title":"Write Protect For Storage Disabled","status":"test","level":"medium","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/75f7a0e2-7154-4c4d-9eae-5cdb4e0a5c13.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_write_protect_for_storage_disabled.yml","author":"Sreeman","kind":"sigma"},{"id":"023c654f-8f16-44d9-bb2b-00ff36a62af9","title":"Python Function Execution Security Warning Disabled In Excel","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/023c654f-8f16-44d9-bb2b-00ff36a62af9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_registry_office_disable_python_security_warnings.yml","author":"@Kostastsale","kind":"sigma"},{"id":"85c312b7-f44d-4a51-a024-d671c40b49fc","title":"Service StartupType Change Via Sc.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/85c312b7-f44d-4a51-a024-d671c40b49fc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sc_disable_service.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"c2c76b77-32be-4d1f-82c9-7e544bdfe0eb","title":"Potential Suspicious Activity Using SeCEdit","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/c2c76b77-32be-4d1f-82c9-7e544bdfe0eb.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_secedit_execution.yml","author":"Janantha Marasinghe","kind":"sigma"},{"id":"a31eeaed-3fd5-478e-a8ba-e62c6b3f9ecc","title":"Raccine Uninstall","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/a31eeaed-3fd5-478e-a8ba-e62c6b3f9ecc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_disable_raccine.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"41421f44-58f9-455d-838a-c398859841d4","title":"ETW Logging Tamper In .NET Processes Via CommandLine","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/41421f44-58f9-455d-838a-c398859841d4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_etw_modification_cmdline.yml","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","kind":"sigma"},{"id":"a238b5d0-ce2d-4414-a676-7a531b3d13d6","title":"ETW Trace Evasion Activity","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/a238b5d0-ce2d-4414-a676-7a531b3d13d6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_etw_trace_evasion.yml","author":"@neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community","kind":"sigma"},{"id":"ce72ef99-22f1-43d4-8695-419dcb5d9330","title":"Suspicious Windows Service Tampering","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/ce72ef99-22f1-43d4-8695-419dcb5d9330.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_service_tamper.yml","author":"Nasreddine Bencherchali (Nextron Systems), frack113 , X__Junior (Nextron Systems)","kind":"sigma"},{"id":"4beb6ae0-f85b-41e2-8f18-8668abc8af78","title":"Sysinternals PsSuspend Suspicious Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/4beb6ae0-f85b-41e2-8f18-8668abc8af78.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sysinternals_pssuspend_susp_execution.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"87911521-7098-470b-a459-9a57fc80bdfd","title":"Sysmon Configuration Update","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/87911521-7098-470b-a459-9a57fc80bdfd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sysinternals_sysmon_config_update.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"6a5f68d1-c4b5-46b9-94ee-5324892ea939","title":"Uninstall Sysinternals Sysmon","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/6a5f68d1-c4b5-46b9-94ee-5324892ea939.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sysinternals_sysmon_uninstall.yml","author":"frack113","kind":"sigma"},{"id":"4a6713f6-3331-11ed-a261-0242ac120002","title":"Taskkill Symantec Endpoint Protection","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/4a6713f6-3331-11ed-a261-0242ac120002.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_taskkill_sep.yml","author":"Ilya Krestinichev, Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"f0f7be61-9cf5-43be-9836-99d6ef448a18","title":"Uninstall Crowdstrike Falcon Sensor","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/f0f7be61-9cf5-43be-9836-99d6ef448a18.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_uninstall_crowdstrike_falcon.yml","author":"frack113","kind":"sigma"},{"id":"22154f0e-5132-4a54-aa78-cc62f6def531","title":"Vulnerable Driver Blocklist Registry Tampering Via CommandLine","status":"experimental","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/22154f0e-5132-4a54-aa78-cc62f6def531.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_vulnerable_driver_blocklist_registry_tampering.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"1f0b4cac-9c81-41f4-95d0-8475ff46b3e2","title":"PPL Tampering Via WerFaultSecure","status":"experimental","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/1f0b4cac-9c81-41f4-95d0-8475ff46b3e2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_werfaultsecure_abuse.yml","author":"Jason (https://github.com/0xbcf)","kind":"sigma"},{"id":"51cbac1e-eee3-4a90-b1b7-358efb81fa0a","title":"Potential Windows Defender Tampering Via Wmic.EXE","status":"test","level":"high","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/51cbac1e-eee3-4a90-b1b7-358efb81fa0a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wmic_namespace_defender.yml","author":"frack113","kind":"sigma"},{"id":"c0514f28-fdae-42df-b886-06e2b2bc5b37","title":"Service Startup Type Change Via Wmic.EXE","status":"experimental","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/c0514f28-fdae-42df-b886-06e2b2bc5b37.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wmic_service_startup_change.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"847d5ff3-8a31-4737-a970-aeae8fe21765","title":"Potential Tampering With Security Products Via WMIC","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/847d5ff3-8a31-4737-a970-aeae8fe21765.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wmic_uninstall_security_products.yml","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"d645ef86-2396-48a1-a2b6-b629ca3f57ff","title":"Windows Credential Guard Related Registry Value Deleted - Registry","status":"experimental","level":"high","logsource":{"category":"registry_delete","product":"windows"},"data_path":"data/detection-rules/d645ef86-2396-48a1-a2b6-b629ca3f57ff.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_delete/registry_delete_disable_credential_guard.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"272e55a4-9e6b-4211-acb6-78f51f0b1b40","title":"Folder Removed From Exploit Guard ProtectedFolders List - Registry","status":"test","level":"high","logsource":{"category":"registry_delete","product":"windows"},"data_path":"data/detection-rules/272e55a4-9e6b-4211-acb6-78f51f0b1b40.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_delete/registry_delete_exploit_guard_protected_folders.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"41d1058a-aea7-4952-9293-29eaaf516465","title":"Removal Of AMSI Provider Registry Keys","status":"test","level":"high","logsource":{"product":"windows","category":"registry_delete"},"data_path":"data/detection-rules/41d1058a-aea7-4952-9293-29eaaf516465.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_delete/registry_delete_removal_amsi_registry_key.yml","author":"frack113","kind":"sigma"},{"id":"526cc8bc-1cdc-48ad-8b26-f19bff969cec","title":"Removal Of Index Value to Hide Schedule Task - Registry","status":"test","level":"medium","logsource":{"product":"windows","category":"registry_delete"},"data_path":"data/detection-rules/526cc8bc-1cdc-48ad-8b26-f19bff969cec.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_index_value_removal.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"acd74772-5f88-45c7-956b-6a7b36c294d2","title":"Removal Of SD Value to Hide Schedule Task - Registry","status":"test","level":"medium","logsource":{"product":"windows","category":"registry_delete"},"data_path":"data/detection-rules/acd74772-5f88-45c7-956b-6a7b36c294d2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_sd_value_removal.yml","author":"Sittikorn S","kind":"sigma"},{"id":"5a9e1b2c-8f7d-4a1e-9b3c-0f6d7e5a4b1f","title":"Windows Defender Threat Severity Default Action Modified","status":"experimental","level":"high","logsource":{"category":"registry_event","product":"windows"},"data_path":"data/detection-rules/5a9e1b2c-8f7d-4a1e-9b3c-0f6d7e5a4b1f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_event/registry_event_defender_threat_action_modified.yml","author":"Matt Anderson (Huntress)","kind":"sigma"},{"id":"d67572a0-e2ec-45d6-b8db-c100d14b8ef2","title":"NetNTLM Downgrade Attack - Registry","status":"test","level":"high","logsource":{"product":"windows","category":"registry_event"},"data_path":"data/detection-rules/d67572a0-e2ec-45d6-b8db-c100d14b8ef2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_event/registry_event_net_ntlm_downgrade.yml","author":"Florian Roth (Nextron Systems), wagga, Nasreddine Bencherchali (Splunk STRT)","kind":"sigma"},{"id":"4d431012-2ab5-4db7-a84e-b29809da2172","title":"Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback","status":"test","level":"medium","logsource":{"product":"windows","category":"registry_set"},"data_path":"data/detection-rules/4d431012-2ab5-4db7-a84e-b29809da2172.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_event/registry_set_enable_anonymous_connection.yml","author":"X__Junior (Nextron Systems)","kind":"sigma"},{"id":"160d2780-31f7-4922-8b3a-efce30e63e96","title":"Potential AMSI COM Server Hijacking","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/160d2780-31f7-4922-8b3a-efce30e63e96.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_amsi_com_hijack.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"aa37cbb0-da36-42cb-a90f-fdf216fc7467","title":"AMSI Disabled via Registry Modification","status":"experimental","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/aa37cbb0-da36-42cb-a90f-fdf216fc7467.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_amsi_disable.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"4916a35e-bfc4-47d0-8e25-a003d7067061","title":"Sysmon Driver Altitude Change","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/4916a35e-bfc4-47d0-8e25-a003d7067061.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_change_sysmon_driver_altitude.yml","author":"B.Talebi","kind":"sigma"},{"id":"73921b9c-cafd-4446-b0c6-fdb0ace42bc0","title":"Windows Credential Guard Disabled - Registry","status":"experimental","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/73921b9c-cafd-4446-b0c6-fdb0ace42bc0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_credential_guard_disabled.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"a982fc9c-6333-4ffb-a51d-addb04e8b529","title":"Windows Defender Exclusions Added - Registry","status":"test","level":"medium","logsource":{"product":"windows","category":"registry_set"},"data_path":"data/detection-rules/a982fc9c-6333-4ffb-a51d-addb04e8b529.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_defender_exclusions.yml","author":"Christian Burkard (Nextron Systems)","kind":"sigma"},{"id":"31e124fb-5dc4-42a0-83b3-44a69c77b271","title":"Antivirus Filter Driver Disallowed On Dev Drive - Registry","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/31e124fb-5dc4-42a0-83b3-44a69c77b271.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_devdrv_disallow_antivirus_filter.yml","author":"@kostastsale, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"8b7273a4-ba5d-4d8a-b04f-11f2900d043a","title":"Windows Hypervisor Enforced Code Integrity Disabled","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/8b7273a4-ba5d-4d8a-b04f-11f2900d043a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_deviceguard_hypervisorenforcedcodeintegrity_disabled.yml","author":"Nasreddine Bencherchali (Nextron Systems), Anish Bogati","kind":"sigma"},{"id":"7f2954d2-99c2-4d42-a065-ca36740f187b","title":"Hypervisor Enforced Paging Translation Disabled","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/7f2954d2-99c2-4d42-a065-ca36740f187b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_deviceguard_hypervisorenforcedpagingtranslation_disabled.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b","title":"Disable Privacy Settings Experience in Registry","status":"test","level":"medium","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_disable_privacy_settings_experience.yml","author":"frack113","kind":"sigma"},{"id":"e1aa95de-610a-427d-b9e7-9b46cfafbe6a","title":"Windows Defender Service Disabled - Registry","status":"test","level":"high","logsource":{"product":"windows","category":"registry_set"},"data_path":"data/detection-rules/e1aa95de-610a-427d-b9e7-9b46cfafbe6a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_disable_windows_defender_service.yml","author":"Ján Trenčanský, frack113, AlertIQ, Nasreddine Bencherchali","kind":"sigma"},{"id":"bf9e1387-b040-4393-9851-1598f8ecfae9","title":"Disable Exploit Guard Network Protection on Windows Defender","status":"test","level":"medium","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/bf9e1387-b040-4393-9851-1598f8ecfae9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_disabled_exploit_guard_net_protection_on_ms_defender.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"fcddca7c-b9c0-4ddf-98da-e1e2d18b0157","title":"Disabled Windows Defender Eventlog","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/fcddca7c-b9c0-4ddf-98da-e1e2d18b0157.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_disabled_microsoft_defender_eventlog.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"8ffc5407-52e3-478f-9596-0a7371eafe13","title":"Disable PUA Protection on Windows Defender","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/8ffc5407-52e3-478f-9596-0a7371eafe13.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_disabled_pua_protection_on_microsoft_defender.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"93d298a1-d28f-47f1-a468-d971e7796679","title":"Disable Tamper Protection on Windows Defender","status":"test","level":"medium","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/93d298a1-d28f-47f1-a468-d971e7796679.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_disabled_tamper_protection_on_microsoft_defender.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"bf4fc428-dcc3-4bbd-99fe-2422aeee2544","title":"ETW Logging Disabled In .NET Processes - Sysmon Registry","status":"test","level":"high","logsource":{"product":"windows","category":"registry_set"},"data_path":"data/detection-rules/bf4fc428-dcc3-4bbd-99fe-2422aeee2544.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_dot_net_etw_tamper.yml","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","kind":"sigma"},{"id":"7d995e63-ec83-4aa3-89d5-8a17b5c87c86","title":"Scripted Diagnostics Turn Off Check Enabled - Registry","status":"test","level":"medium","logsource":{"product":"windows","category":"registry_set"},"data_path":"data/detection-rules/7d995e63-ec83-4aa3-89d5-8a17b5c87c86.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_enabling_turnoffcheck.yml","author":"Christopher Peacock @securepeacock, SCYTHE @scythe_io","kind":"sigma"},{"id":"42205c73-75c8-4a63-9db1-e3782e06fda0","title":"Suspicious Application Allowed Through Exploit Guard","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/42205c73-75c8-4a63-9db1-e3782e06fda0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_exploit_guard_susp_allowed_apps.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"5b16df71-8615-4f7f-ac9b-6c43c0509e61","title":"Hide Schedule Task Via Index Value Tamper","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/5b16df71-8615-4f7f-ac9b-6c43c0509e61.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_hide_scheduled_task_via_index_tamper.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"b888e3f2-224d-4435-b00b-9dd66e9ea1f1","title":"Uncommon Extension In Keyboard Layout IME File Registry Value","status":"test","level":"high","logsource":{"product":"windows","category":"registry_set"},"data_path":"data/detection-rules/b888e3f2-224d-4435-b00b-9dd66e9ea1f1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_ime_non_default_extension.yml","author":"X__Junior (Nextron Systems)","kind":"sigma"},{"id":"9d8f9bb8-01af-4e15-a3a2-349071530530","title":"Suspicious Path In Keyboard Layout IME File Registry Value","status":"test","level":"high","logsource":{"product":"windows","category":"registry_set"},"data_path":"data/detection-rules/9d8f9bb8-01af-4e15-a3a2-349071530530.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_ime_suspicious_paths.yml","author":"X__Junior (Nextron Systems)","kind":"sigma"},{"id":"a5c7a43f-6009-4a8c-80c5-32abf1c53ecc","title":"Microsoft Office Protected View Disabled","status":"test","level":"high","logsource":{"product":"windows","category":"registry_set"},"data_path":"data/detection-rules/a5c7a43f-6009-4a8c-80c5-32abf1c53ecc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_office_disable_protected_view_features.yml","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"17e53739-a1fc-4a62-b1b9-87711c2d5e44","title":"Python Function Execution Security Warning Disabled In Excel - Registry","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/17e53739-a1fc-4a62-b1b9-87711c2d5e44.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_office_disable_python_security_warnings.yml","author":"Nasreddine Bencherchali (Nextron Systems), @Kostastsale","kind":"sigma"},{"id":"90f342e1-1aaa-4e43-b092-39fda57ed11e","title":"ETW Logging Disabled For rpcrt4.dll","status":"test","level":"low","logsource":{"product":"windows","category":"registry_set"},"data_path":"data/detection-rules/90f342e1-1aaa-4e43-b092-39fda57ed11e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_rpcrt4_etw_tamper.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"4f281b83-0200-4b34-bf35-d24687ea57c2","title":"ETW Logging Disabled For SCM","status":"test","level":"low","logsource":{"product":"windows","category":"registry_set"},"data_path":"data/detection-rules/4f281b83-0200-4b34-bf35-d24687ea57c2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_services_etw_tamper.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"9f4662ac-17ca-43aa-8f12-5d7b989d0101","title":"Tamper With Sophos AV Registry Keys","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/9f4662ac-17ca-43aa-8f12-5d7b989d0101.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_sophos_av_tamper.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"f2485272-a156-4773-82d7-1d178bc4905b","title":"Suspicious Service Installed","status":"test","level":"medium","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/f2485272-a156-4773-82d7-1d178bc4905b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_susp_service_installed.yml","author":"xknow (@xknow_infosec), xorxes (@xor_xes)","kind":"sigma"},{"id":"1f1d8209-636e-4c6c-a137-781cca8b82f9","title":"WFP Filter Added via Registry","status":"experimental","level":"medium","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/1f1d8209-636e-4c6c-a137-781cca8b82f9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_susp_wfp_filter_added.yml","author":"Frack113","kind":"sigma"},{"id":"d526c60a-e236-4011-b165-831ffa52ab70","title":"Windows Vulnerable Driver Blocklist Disabled","status":"experimental","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/d526c60a-e236-4011-b165-831ffa52ab70.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_vulnerable_driver_blocklist_disable.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"0eb46774-f1ab-4a74-8238-1155855f2263","title":"Disable Windows Defender Functionalities Via Registry Keys","status":"test","level":"high","logsource":{"product":"windows","category":"registry_set"},"data_path":"data/detection-rules/0eb46774-f1ab-4a74-8238-1155855f2263.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_windows_defender_tamper.yml","author":"AlertIQ, Ján Trenčanský, frack113, Nasreddine Bencherchali, Swachchhanda Shrawan Poudel","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0497","name":"Detection of Defense Impairment through Disabled or Modified Tools across OS Platforms.","url":"https://attack.mitre.org/detectionstrategies/DET0497","stix_id":"x-mitre-detection-strategy--a21019ad-f6d2-4806-be7b-01ba27c63147","relationship_id":"relationship--ce5ab389-680d-4055-91a8-1111e5530bfa","description":"","analytics":[{"id":"AN1369","name":"Analytic 1369","guidance":"Detection of adversary behavior that disables or modifies security tools, including killing AV/EDR processes, stopping services, altering Sysmon registry keys, or tampering with exclusion lists. Defenders observe process/service termination, registry modification, and abnormal absence of expected telemetry.","url":"https://attack.mitre.org/detectionstrategies/DET0497#AN1369","platforms":["Windows"],"tuning":[{"field":"ProcessNameExclusions","description":"List of expected administrative tools/processes to prevent false positives."},{"field":"TimeWindow","description":"Defines correlation window linking process termination, registry edits, and service stoppage."},{"field":"ServiceNames","description":"Customizable list of security service names per enterprise deployment."}],"log_sources":[{"component_id":"DC0060","component":"Service Creation","name":"WinEventLog:System","channel":"EventCode=7045","platforms":["Windows"],"analytic_id":"AN1369","source_url":"https://attack.mitre.org/detectionstrategies/DET0497#AN1369","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0060/"},{"component_id":"DC0033","component":"Process Termination","name":"WinEventLog:Sysmon","channel":"EventCode=5","platforms":["Windows"],"analytic_id":"AN1369","source_url":"https://attack.mitre.org/detectionstrategies/DET0497#AN1369","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0033/"},{"component_id":"DC0063","component":"Windows Registry Key Modification","name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","platforms":["Windows"],"analytic_id":"AN1369","source_url":"https://attack.mitre.org/detectionstrategies/DET0497#AN1369","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0063/"}]},{"id":"AN1370","name":"Analytic 1370","guidance":"Detects kill/systemctl/service commands against EDR, auditd, falco, osquery, rsyslog, journald, or agent processes; configuration edits disabling startup; module unload attempts; abrupt cessation of logs after privileged shell execution.","url":"https://attack.mitre.org/detectionstrategies/DET0497#AN1370","platforms":["Linux"],"tuning":[{"field":"AgentServiceNames","description":"List of endpoint protection service names (varies across deployments)."},{"field":"AllowedAdminAccounts","description":"Accounts permitted to legitimately stop or reconfigure services."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve: systemctl stop, service stop, or kill -9 on security daemons (e.g., falcon-sensor, auditd)","platforms":["Linux"],"analytic_id":"AN1370","source_url":"https://attack.mitre.org/detectionstrategies/DET0497#AN1370","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0041","component":"Service Metadata","name":"auditd:CONFIG_CHANGE","channel":"delete: Modification of systemd unit files or config for security agents","platforms":["Linux"],"analytic_id":"AN1370","source_url":"https://attack.mitre.org/detectionstrategies/DET0497#AN1370","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0041/"}]},{"id":"AN1371","name":"Analytic 1371","guidance":"Detection of adversary disabling endpoint security tools by unloading launch agents/daemons, modifying configuration profiles, or disabling Gatekeeper/XProtect/logging settings, or removing endpoint agents followed by telemetry loss.","url":"https://attack.mitre.org/detectionstrategies/DET0497#AN1371","platforms":["macOS"],"tuning":[{"field":"DaemonNames","description":"Expected security agent daemons (e.g., com.crowdstrike.falcon.Agent)."},{"field":"TimeWindow","description":"Detection correlation period for multiple security tool disable actions."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"Execution of launchctl unload, kill, or removal of security agent daemons","platforms":["macOS"],"analytic_id":"AN1371","source_url":"https://attack.mitre.org/detectionstrategies/DET0497#AN1371","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0041","component":"Service Metadata","name":"macos:unifiedlog","channel":"Modification of system configuration profiles affecting security tools","platforms":["macOS"],"analytic_id":"AN1371","source_url":"https://attack.mitre.org/detectionstrategies/DET0497#AN1371","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0041/"}]},{"id":"AN1372","name":"Analytic 1372","guidance":"Correlates control-plane API actions disabling cloud-native monitoring or sensor agents (CloudTrail, GuardDuty, Security Hub, Defender, monitoring agents), role abuse preceding disablement, or instance agent uninstall events","url":"https://attack.mitre.org/detectionstrategies/DET0497#AN1372","platforms":["IaaS"],"tuning":[{"field":"APIActions","description":"Customizable list of cloud provider API calls related to monitoring/alerting disablement."},{"field":"UserContext","description":"Distinguishes adversary actions from authorized DevOps/CloudOps activities."}],"log_sources":[{"component_id":"DC0069","component":"Cloud Service Modification","name":"AWS:CloudTrail","channel":"Delete* / Stop*: DeleteAlarms, StopLogging, or DisableMonitoring API calls","platforms":["IaaS"],"analytic_id":"AN1372","source_url":"https://attack.mitre.org/detectionstrategies/DET0497#AN1372","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0069/"}]},{"id":"AN1373","name":"Analytic 1373","guidance":"Detects disabling container runtime security controls, removing sidecar sensors, modifying seccomp/AppArmor profiles, mounting host proc/sys paths to interfere with host logging, or killing in-container monitoring agents.","url":"https://attack.mitre.org/detectionstrategies/DET0497#AN1373","platforms":["Containers"],"tuning":[{"field":"NamespaceExclusions","description":"Exclusion of namespaces where temporary deletion of monitoring tools is legitimate (e.g., staging)."}],"log_sources":[{"component_id":"DC0041","component":"Service Metadata","name":"kubernetes:audit","channel":"kubectl delete or patch of security pods/admission controllers","platforms":["Containers"],"analytic_id":"AN1373","source_url":"https://attack.mitre.org/detectionstrategies/DET0497#AN1373","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0041/"}]},{"id":"AN1374","name":"Analytic 1374","guidance":"Detects disabling AAA, syslog, SNMP traps, ACL logging, or security features on routers/switches/firewalls; correlates privileged login followed by configuration commit reducing visibility.","url":"https://attack.mitre.org/detectionstrategies/DET0497#AN1374","platforms":["Network Devices"],"tuning":[{"field":"ConfigBaseline","description":"Reference configuration state for detecting unauthorized modifications."}],"log_sources":[{"component_id":"DC0041","component":"Service Metadata","name":"networkdevice:config","channel":"write: Startup configuration changes disabling security checks","platforms":["Network Devices"],"analytic_id":"AN1374","source_url":"https://attack.mitre.org/detectionstrategies/DET0497#AN1374","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0041/"},{"component_id":"DC0018","component":"Host Status","name":"networkdevice:syslog","channel":"no logging host, no aaa new-model, no snmp-server, commit","platforms":["Network Devices"],"analytic_id":"AN1374","source_url":"https://attack.mitre.org/detectionstrategies/DET0497#AN1374","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0018/"}]},{"id":"AN2044","name":"Analytic 2044","guidance":"Detects esxcli commands disabling syslog, firewall, lockdown mode, or stopping hostd/vpxa; correlates command execution with reduced forwarding activity.","url":"https://attack.mitre.org/detectionstrategies/DET0497#AN2044","platforms":["ESXi"],"tuning":[{"field":"ExpectedAdminIPs","description":"Authorized management sources."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"esxi:shell","channel":"esxcli system syslog config set/reload, services.sh restart/stop","platforms":["ESXi"],"analytic_id":"AN2044","source_url":"https://attack.mitre.org/detectionstrategies/DET0497#AN2044","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0065","component":"Service Modification","name":"esxi:hostd","channel":"service state change","platforms":["ESXi"],"analytic_id":"AN2044","source_url":"https://attack.mitre.org/detectionstrategies/DET0497#AN2044","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0065/"}]}]}],"telemetry_references":[{"id":"DC0069","name":"Cloud Service Modification","tag":"Cloud Service Modification","page":"telemetry/DC0069/","kind":"attack_component"},{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0018","name":"Host Status","tag":"Host Status","page":"telemetry/DC0018/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0033","name":"Process Termination","tag":"Process Termination","page":"telemetry/DC0033/","kind":"attack_component"},{"id":"DC0060","name":"Service Creation","tag":"Service Creation","page":"telemetry/DC0060/","kind":"attack_component"},{"id":"DC0041","name":"Service Metadata","tag":"Service Metadata","page":"telemetry/DC0041/","kind":"attack_component"},{"id":"DC0065","name":"Service Modification","tag":"Service Modification","page":"telemetry/DC0065/","kind":"attack_component"},{"id":"DC0063","name":"Windows Registry Key Modification","tag":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S1063","name":"Brute Ratel C4","page":"tools/S1063/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S9017","name":"DCRAT","page":"tools/S9017/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0695","name":"Donut","page":"tools/S0695/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0434","name":"Imminent Monitor","page":"tools/S0434/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S1063","name":"Brute Ratel C4","page":"tools/S1063/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S9017","name":"DCRAT","page":"tools/S9017/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0695","name":"Donut","page":"tools/S0695/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0434","name":"Imminent Monitor","page":"tools/S0434/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0004","name":"TinyZBot","url":"https://attack.mitre.org/software/S0004","kind":"malware","description":"[TinyZBot](https://attack.mitre.org/software/S0004) can disable Avira anti-virus.(Citation: Cylance Cleaver)","relationship_id":"relationship--2f132e5d-680c-4394-b4c7-c808cc3aadf6","references":[{"source_name":"Cylance Cleaver","description":"Cylance. (2014, December). Operation Cleaver. Retrieved September 14, 2017.","url":"https://web.archive.org/web/20200302085133/https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf"}]},{"id":"S0058","name":"SslMM","url":"https://attack.mitre.org/software/S0058","kind":"malware","description":"[SslMM](https://attack.mitre.org/software/S0058) identifies and kills anti-malware processes.(Citation: Baumgartner Naikon 2015)","relationship_id":"relationship--d9ac84a2-f7be-4bd2-9c52-f1f5c68a99d5","references":[{"source_name":"Baumgartner Naikon 2015","description":"Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf"}]},{"id":"S0061","name":"HDoor","url":"https://attack.mitre.org/software/S0061","kind":"malware","description":"[HDoor](https://attack.mitre.org/software/S0061) kills anti-virus found on the victim.(Citation: Baumgartner Naikon 2015)","relationship_id":"relationship--ec31ed0a-920e-469f-a7b3-5adcb0db8f61","references":[{"source_name":"Baumgartner Naikon 2015","description":"Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf"}]},{"id":"S0130","name":"Unknown Logger","url":"https://attack.mitre.org/software/S0130","kind":"malware","description":"[Unknown Logger](https://attack.mitre.org/software/S0130) has functionality to disable security tools, including Kaspersky, BitDefender, and MalwareBytes.(Citation: Forcepoint Monsoon)","relationship_id":"relationship--4a0eb081-8a12-4ae3-a1f5-b45b39ac56b6","references":[{"source_name":"Forcepoint Monsoon","description":"Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016.","url":"https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"}]},{"id":"S0132","name":"H1N1","url":"https://attack.mitre.org/software/S0132","kind":"malware","description":"[H1N1](https://attack.mitre.org/software/S0132) kills and disables services for Windows Security Center, and Windows Defender.(Citation: Cisco H1N1 Part 2)","relationship_id":"relationship--cd217830-522c-4be3-9179-c6e28cfac122","references":[{"source_name":"Cisco H1N1 Part 2","description":"Reynolds, J.. (2016, September 14). H1N1: Technical analysis reveals new capabilities – part 2. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20231210122239/https://blogs.cisco.com/security/h1n1-technical-analysis-reveals-new-capabilities-part-2"}]},{"id":"S0144","name":"ChChes","url":"https://attack.mitre.org/software/S0144","kind":"malware","description":"[ChChes](https://attack.mitre.org/software/S0144) can alter the victim's proxy configuration.(Citation: PWC Cloud Hopper Technical Annex April 2017)","relationship_id":"relationship--9761057f-d788-4dfd-8480-c4efa899b72e","references":[{"source_name":"PWC Cloud Hopper Technical Annex April 2017","description":"PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"}]},{"id":"S0154","name":"Cobalt Strike","url":"https://attack.mitre.org/software/S0154","kind":"malware","description":"[Cobalt Strike](https://attack.mitre.org/software/S0154) has the ability to use Smart Applet attacks to disable the Java SecurityManager sandbox.(Citation: Talos Cobalt Strike September 2020)(Citation: Cobalt Strike Manual 4.3 November 2020)","relationship_id":"relationship--8c4af801-00dc-4aa2-acd4-6608fb258088","references":[{"source_name":"Talos Cobalt Strike September 2020","description":"Mavis, N. (2020, September 21). The Art and Science of Detecting Cobalt Strike. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20210219195905/https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/031/original/Talos_Cobalt_Strike.pdf"},{"source_name":"Cobalt Strike Manual 4.3 November 2020","description":"Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021.","url":"https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"}]},{"id":"S0201","name":"JPIN","url":"https://attack.mitre.org/software/S0201","kind":"malware","description":"[JPIN](https://attack.mitre.org/software/S0201) can lower security settings by changing Registry keys.(Citation: Microsoft PLATINUM April 2016)","relationship_id":"relationship--08ced821-8f14-4c59-ba35-d5d836b3f7b8","references":[{"source_name":"Microsoft PLATINUM April 2016","description":"Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.","url":"https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"}]},{"id":"S0223","name":"POWERSTATS","url":"https://attack.mitre.org/software/S0223","kind":"malware","description":"[POWERSTATS](https://attack.mitre.org/software/S0223) can disable Microsoft Office Protected View by changing Registry keys.(Citation: FireEye MuddyWater Mar 2018)","relationship_id":"relationship--9eee0829-17ee-4fe4-8adb-ca1ab463f4d2","references":[{"source_name":"FireEye MuddyWater Mar 2018","description":"Singh, S. et al.. (2018, March 13). Iranian Threat Group Updates Tactics, Techniques and Procedures in Spear Phishing Campaign. Retrieved April 11, 2018.","url":"https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html"}]},{"id":"S0228","name":"NanHaiShu","url":"https://attack.mitre.org/software/S0228","kind":"malware","description":"[NanHaiShu](https://attack.mitre.org/software/S0228) can change Internet Explorer settings to reduce warnings about malware activity.(Citation: Proofpoint Leviathan Oct 2017)","relationship_id":"relationship--38bde25a-6e15-4c7a-91e6-4758d113049b","references":[{"source_name":"Proofpoint Leviathan Oct 2017","description":"Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"}]},{"id":"S0249","name":"Gold Dragon","url":"https://attack.mitre.org/software/S0249","kind":"malware","description":"[Gold Dragon](https://attack.mitre.org/software/S0249) terminates anti-malware processes if they’re found running on the system.(Citation: McAfee Gold Dragon)","relationship_id":"relationship--1f0d3fa4-7ed4-4487-be95-2c6af1e271ea","references":[{"source_name":"McAfee Gold Dragon","description":"Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"}]},{"id":"S0252","name":"Brave Prince","url":"https://attack.mitre.org/software/S0252","kind":"malware","description":"[Brave Prince](https://attack.mitre.org/software/S0252) terminates antimalware processes.(Citation: McAfee Gold Dragon)","relationship_id":"relationship--4adc5d0c-a757-4cce-afbc-c0a08bd6aecf","references":[{"source_name":"McAfee Gold Dragon","description":"Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"}]},{"id":"S0253","name":"RunningRAT","url":"https://attack.mitre.org/software/S0253","kind":"malware","description":"[RunningRAT](https://attack.mitre.org/software/S0253) kills antimalware running process.(Citation: McAfee Gold Dragon)","relationship_id":"relationship--2471f5b2-7d7a-4df3-99d0-18e05aec0f4d","references":[{"source_name":"McAfee Gold Dragon","description":"Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"}]},{"id":"S0266","name":"TrickBot","url":"https://attack.mitre.org/software/S0266","kind":"malware","description":"[TrickBot](https://attack.mitre.org/software/S0266) can disable Windows Defender.(Citation: Trend Micro Trickbot Nov 2018)","relationship_id":"relationship--a50c7617-3148-4a0a-bf60-0c32171d6a9f","references":[{"source_name":"Trend Micro Trickbot Nov 2018","description":"Anthony, N., Pascual, C.. (2018, November 1). Trickbot Shows Off New Trick: Password Grabber Module. Retrieved November 16, 2018.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-shows-off-new-trick-password-grabber-module/"}]},{"id":"S0279","name":"Proton","url":"https://attack.mitre.org/software/S0279","kind":"malware","description":"[Proton](https://attack.mitre.org/software/S0279) kills security tools like Wireshark that are running.(Citation: objsee mac malware 2017)","relationship_id":"relationship--73b90d32-5377-4654-b65e-390b1184350d","references":[{"source_name":"objsee mac malware 2017","description":"Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.","url":"https://objective-see.com/blog/blog_0x25.html"}]},{"id":"S0331","name":"Agent Tesla","url":"https://attack.mitre.org/software/S0331","kind":"malware","description":"[Agent Tesla](https://attack.mitre.org/software/S0331) has the capability to kill any running analysis processes and AV software.(Citation: Fortinet Agent Tesla June 2017)","relationship_id":"relationship--b3ac34c3-2559-4812-b143-a89805d78d49","references":[{"source_name":"Fortinet Agent Tesla June 2017","description":"Zhang, X. (2017, June 28). In-Depth Analysis of A New Variant of .NET Malware AgentTesla. Retrieved November 5, 2018.","url":"https://www.fortinet.com/blog/threat-research/in-depth-analysis-of-net-malware-javaupdtr.html"}]},{"id":"S0334","name":"DarkComet","url":"https://attack.mitre.org/software/S0334","kind":"malware","description":"[DarkComet](https://attack.mitre.org/software/S0334) can disable Security Center functions like anti-virus.(Citation: TrendMicro DarkComet Sept 2014)(Citation: Malwarebytes DarkComet March 2018)","relationship_id":"relationship--b520cfd5-438e-4f73-931b-c058ada04e2e","references":[{"source_name":"TrendMicro DarkComet Sept 2014","description":"TrendMicro. (2014, September 03). DARKCOMET. Retrieved November 6, 2018.","url":"https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/DARKCOMET"},{"source_name":"Malwarebytes DarkComet March 2018","description":"Kujawa, A. (2018, March 27). You dirty RAT! Part 1: DarkComet. Retrieved November 6, 2018.","url":"https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/"}]},{"id":"S0336","name":"NanoCore","url":"https://attack.mitre.org/software/S0336","kind":"malware","description":"[NanoCore](https://attack.mitre.org/software/S0336) can modify the victim's anti-virus.(Citation: DigiTrust NanoCore Jan 2017)(Citation: PaloAlto NanoCore Feb 2016)","relationship_id":"relationship--5cd2bb27-c043-455f-b67f-88ec4bbe2d93","references":[{"source_name":"DigiTrust NanoCore Jan 2017","description":"The DigiTrust Group. (2017, January 01). NanoCore Is Not Your Average RAT. Retrieved November 9, 2018.","url":"https://www.digitrustgroup.com/nanocore-not-your-average-rat/"},{"source_name":"PaloAlto NanoCore Feb 2016","description":"Kasza, A., Halfpop, T. (2016, February 09). NanoCoreRAT Behind an Increase in Tax-Themed Phishing E-mails. Retrieved November 9, 2018.","url":"https://researchcenter.paloaltonetworks.com/2016/02/nanocorerat-behind-an-increase-in-tax-themed-phishing-e-mails/"}]},{"id":"S0372","name":"LockerGoga","url":"https://attack.mitre.org/software/S0372","kind":"malware","description":"[LockerGoga](https://attack.mitre.org/software/S0372) installation has been immediately preceded by a \"task kill\" command in order to disable anti-virus.(Citation: Wired Lockergoga 2019)","relationship_id":"relationship--76a951cd-cb2c-485a-9596-b0df6302ba41","references":[{"source_name":"Wired Lockergoga 2019","description":"Greenberg, A. (2019, March 25). A Guide to LockerGoga, the Ransomware Crippling Industrial Firms. Retrieved July 17, 2019.","url":"https://www.wired.com/story/lockergoga-ransomware-crippling-industrial-firms/"}]},{"id":"S0377","name":"Ebury","url":"https://attack.mitre.org/software/S0377","kind":"malware","description":"[Ebury](https://attack.mitre.org/software/S0377) can disable SELinux Role-Based Access Control and deactivate PAM modules.(Citation: ESET Ebury Oct 2017)","relationship_id":"relationship--be278ea8-19b6-4d42-ac7f-9ee8681a17e3","references":[{"source_name":"ESET Ebury Oct 2017","description":"Vachon, F. (2017, October 30). Windigo Still not Windigone: An Ebury Update . Retrieved February 10, 2021.","url":"https://www.welivesecurity.com/2017/10/30/windigo-ebury-update-2/"}]},{"id":"S0400","name":"RobbinHood","url":"https://attack.mitre.org/software/S0400","kind":"malware","description":"[RobbinHood](https://attack.mitre.org/software/S0400) will search for Windows services that are associated with antivirus software on the system and kill the process.(Citation: CarbonBlack RobbinHood May 2019) ","relationship_id":"relationship--8b1f5571-85d6-4077-aa79-48064b9bc7ef","references":[{"source_name":"CarbonBlack RobbinHood May 2019","description":"Lee, S. (2019, May 17). CB TAU Threat Intelligence Notification: RobbinHood Ransomware Stops 181 Windows Services Before Encryption. Retrieved July 29, 2019.","url":"https://www.carbonblack.com/2019/05/17/cb-tau-threat-intelligence-notification-robbinhood-ransomware-stops-181-windows-services-before-encryption/"}]},{"id":"S0412","name":"ZxShell","url":"https://attack.mitre.org/software/S0412","kind":"malware","description":"[ZxShell](https://attack.mitre.org/software/S0412) can kill AV products' processes.(Citation: Talos ZxShell Oct 2014) ","relationship_id":"relationship--972c54cf-a25e-4f25-adbe-28f367327098","references":[{"source_name":"Talos ZxShell Oct 2014","description":"Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.","url":"https://blogs.cisco.com/security/talos/opening-zxshell"}]},{"id":"S0434","name":"Imminent Monitor","url":"https://attack.mitre.org/software/S0434","kind":"tool","description":"[Imminent Monitor](https://attack.mitre.org/software/S0434) has a feature to disable Windows Task Manager.(Citation: Imminent Unit42 Dec2019)\t","relationship_id":"relationship--6b7468ec-604a-48fb-b5d0-c96c47714a8c","references":[{"source_name":"Imminent Unit42 Dec2019","description":"Unit 42. (2019, December 2). Imminent Monitor – a RAT Down Under. Retrieved May 5, 2020.","url":"https://unit42.paloaltonetworks.com/imminent-monitor-a-rat-down-under/"}]},{"id":"S0446","name":"Ryuk","url":"https://attack.mitre.org/software/S0446","kind":"malware","description":"[Ryuk](https://attack.mitre.org/software/S0446) has stopped services related to anti-virus.(Citation: FireEye Ryuk and Trickbot January 2019)","relationship_id":"relationship--976be974-62dc-462e-9a5c-2b389d177d3c","references":[{"source_name":"FireEye Ryuk and Trickbot January 2019","description":"Goody, K., et al (2019, January 11). A Nasty Trick: From Credential Theft Malware to Business Disruption. Retrieved May 12, 2020.","url":"https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html"}]},{"id":"S0449","name":"Maze","url":"https://attack.mitre.org/software/S0449","kind":"malware","description":"[Maze](https://attack.mitre.org/software/S0449) has disabled dynamic analysis and other security tools including IDA debugger, x32dbg, and OllyDbg.(Citation: McAfee Maze March 2020) It has also disabled Windows Defender's Real-Time Monitoring feature and attempted to disable endpoint protection services.(Citation: Sophos Maze VM September 2020)","relationship_id":"relationship--adbff6cf-1e16-460e-88ed-a0288ab32e68","references":[{"source_name":"McAfee Maze March 2020","description":"Mundo, A. (2020, March 26). Ransomware Maze. Retrieved May 18, 2020.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ransomware-maze/"},{"source_name":"Sophos Maze VM September 2020","description":"Brandt, A., Mackenzie, P.. (2020, September 17). Maze Attackers Adopt Ragnar Locker Virtual Machine Technique. Retrieved October 9, 2020.","url":"https://news.sophos.com/en-us/2020/09/17/maze-attackers-adopt-ragnar-locker-virtual-machine-technique/"}]},{"id":"S0455","name":"Metamorfo","url":"https://attack.mitre.org/software/S0455","kind":"malware","description":"[Metamorfo](https://attack.mitre.org/software/S0455) has a function to kill processes associated with defenses and can prevent certain processes from launching.(Citation: Medium Metamorfo Apr 2020)(Citation: FireEye Metamorfo Apr 2018) ","relationship_id":"relationship--cc536085-c3d8-4a94-8db4-bdd942dfecfc","references":[{"source_name":"Medium Metamorfo Apr 2020","description":"Erlich, C. (2020, April 3). The Avast Abuser: Metamorfo Banking Malware Hides By Abusing Avast Executable. Retrieved May 26, 2020.","url":"https://medium.com/@chenerlich/the-avast-abuser-metamorfo-banking-malware-hides-by-abusing-avast-executable-ac9b8b392767"},{"source_name":"FireEye Metamorfo Apr 2018","description":"Sierra, E., Iglesias, G.. (2018, April 24). Metamorfo Campaigns Targeting Brazilian Users. Retrieved July 30, 2020.","url":"https://www.fireeye.com/blog/threat-research/2018/04/metamorfo-campaign-targeting-brazilian-users.html"}]},{"id":"S0457","name":"Netwalker","url":"https://attack.mitre.org/software/S0457","kind":"malware","description":"[Netwalker](https://attack.mitre.org/software/S0457) can detect and terminate active security software-related processes on infected systems.(Citation: TrendMicro Netwalker May 2020)(Citation: Sophos Netwalker May 2020)","relationship_id":"relationship--17a88462-297f-415c-b993-eaac0d4f91e3","references":[{"source_name":"TrendMicro Netwalker May 2020","description":"Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/netwalker-fileless-ransomware-injected-via-reflective-loading/"},{"source_name":"Sophos Netwalker May 2020","description":"Szappanos, G., Brandt, A.. (2020, May 27). Netwalker ransomware tools give insight into threat actor. Retrieved May 27, 2020.","url":"https://news.sophos.com/en-us/2020/05/27/netwalker-ransomware-tools-give-insight-into-threat-actor/"}]},{"id":"S0468","name":"Skidmap","url":"https://attack.mitre.org/software/S0468","kind":"malware","description":"[Skidmap](https://attack.mitre.org/software/S0468) has the ability to set SELinux to permissive mode.(Citation: Trend Micro Skidmap)","relationship_id":"relationship--3ee9c6bb-90c4-476d-b516-020113a65c62","references":[{"source_name":"Trend Micro Skidmap","description":"Remillano, A., Urbanec, J. (2019, September 19). Skidmap Linux Malware Uses Rootkit Capabilities to Hide Cryptocurrency-Mining Payload. Retrieved June 4, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/skidmap-linux-malware-uses-rootkit-capabilities-to-hide-cryptocurrency-mining-payload/"}]},{"id":"S0477","name":"Goopy","url":"https://attack.mitre.org/software/S0477","kind":"malware","description":"[Goopy](https://attack.mitre.org/software/S0477) has the ability to disable Microsoft Outlook's security policies to disable macro warnings.(Citation: Cybereason Cobalt Kitty 2017)\t","relationship_id":"relationship--6fed282b-09d5-4ec6-ac3b-356329c9ad6a","references":[{"source_name":"Cybereason Cobalt Kitty 2017","description":"Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"id":"S0481","name":"Ragnar Locker","url":"https://attack.mitre.org/software/S0481","kind":"malware","description":"[Ragnar Locker](https://attack.mitre.org/software/S0481) has attempted to terminate/stop processes and services associated with endpoint security products.(Citation: Sophos Ragnar May 2020)","relationship_id":"relationship--0fef4426-7e24-4ea7-81cf-6b1454f17120","references":[{"source_name":"Sophos Ragnar May 2020","description":"SophosLabs. (2020, May 21). Ragnar Locker ransomware deploys virtual machine to dodge security. Retrieved June 29, 2020.","url":"https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/"}]},{"id":"S0482","name":"Bundlore","url":"https://attack.mitre.org/software/S0482","kind":"malware","description":"[Bundlore](https://attack.mitre.org/software/S0482) can change browser security settings to enable extensions to be installed. [Bundlore](https://attack.mitre.org/software/S0482) uses the <code>pkill cfprefsd</code> command to prevent users from inspecting processes.(Citation: MacKeeper Bundlore Apr 2019)(Citation: 20 macOS Common Tools and Techniques)","relationship_id":"relationship--73f9e48f-a39c-4213-aaf3-86b2e8bf890a","references":[{"source_name":"MacKeeper Bundlore Apr 2019","description":"Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.","url":"https://mackeeper.com/blog/post/610-macos-bundlore-adware-analysis/"},{"source_name":"20 macOS Common Tools and Techniques","description":"Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.","url":"https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/"}]},{"id":"S0484","name":"Carberp","url":"https://attack.mitre.org/software/S0484","kind":"malware","description":"[Carberp](https://attack.mitre.org/software/S0484) has attempted to disable security software by creating a suspended process for the security software and injecting code to delete antivirus core files when the process is resumed.(Citation: Prevx Carberp March 2011)","relationship_id":"relationship--b6c1ee96-2e9d-41fc-b186-a9611ec752df","references":[{"source_name":"Prevx Carberp March 2011","description":"Giuliani, M., Allievi, A. (2011, February 28). Carberp - a modular information stealing trojan. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20231227000328/http://pxnow.prevx.com/content/blog/carberp-a_modular_information_stealing_trojan.pdf"}]},{"id":"S0491","name":"StrongPity","url":"https://attack.mitre.org/software/S0491","kind":"malware","description":"[StrongPity](https://attack.mitre.org/software/S0491) can add directories used by the malware to the Windows Defender exclusions list to prevent detection.(Citation: Talos Promethium June 2020)","relationship_id":"relationship--aaab92fc-4a65-4cea-b1d6-521a4015eb30","references":[{"source_name":"Talos Promethium June 2020","description":"Mercer, W. et al. (2020, June 29). PROMETHIUM extends global reach with StrongPity3 APT. Retrieved July 20, 2020.","url":"https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html"}]},{"id":"S0496","name":"REvil","url":"https://attack.mitre.org/software/S0496","kind":"malware","description":"[REvil](https://attack.mitre.org/software/S0496) can connect to and disable the Symantec server on the victim's network.(Citation: Cylance Sodinokibi July 2019)","relationship_id":"relationship--6d81dacd-8f87-4426-9d04-6bf548420bb0","references":[{"source_name":"Cylance Sodinokibi July 2019","description":"Cylance. (2019, July 3). hreat Spotlight: Sodinokibi Ransomware. Retrieved August 4, 2020.","url":"https://threatvector.cylance.com/en_us/home/threat-spotlight-sodinokibi-ransomware.html"}]},{"id":"S0531","name":"Grandoreiro","url":"https://attack.mitre.org/software/S0531","kind":"malware","description":"[Grandoreiro](https://attack.mitre.org/software/S0531) can hook APIs, kill processes, break file system paths, and change ACLs to prevent security tools from running.(Citation: ESET Grandoreiro April 2020)","relationship_id":"relationship--8bcde5a5-1ef2-4ea5-bb5a-fa8c5d8fcae9","references":[{"source_name":"ESET Grandoreiro April 2020","description":"ESET. (2020, April 28). Grandoreiro: How engorged can an EXE get?. Retrieved November 13, 2020.","url":"https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/"}]},{"id":"S0534","name":"Bazar","url":"https://attack.mitre.org/software/S0534","kind":"malware","description":"[Bazar](https://attack.mitre.org/software/S0534) has manually loaded ntdll from disk in order to identity and remove API hooks set by security products.(Citation: NCC Group Team9 June 2020)\t","relationship_id":"relationship--ce2d78ae-469f-434a-8324-88237240915f","references":[{"source_name":"NCC Group Team9 June 2020","description":"Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020.","url":"https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/"}]},{"id":"S0554","name":"Egregor","url":"https://attack.mitre.org/software/S0554","kind":"malware","description":"[Egregor](https://attack.mitre.org/software/S0554) has disabled Windows Defender to evade protections.(Citation: Intrinsec Egregor Nov 2020)","relationship_id":"relationship--87a43445-69cd-46d6-b164-3ed1b1221bda","references":[{"source_name":"Intrinsec Egregor Nov 2020","description":"Bichet, J. (2020, November 12). Egregor – Prolock: Fraternal Twins ?. Retrieved January 6, 2021.","url":"https://www.intrinsec.com/egregor-prolock/?cn-reloaded=1"}]},{"id":"S0559","name":"SUNBURST","url":"https://attack.mitre.org/software/S0559","kind":"malware","description":"[SUNBURST](https://attack.mitre.org/software/S0559) attempted to disable software security services following checks against a FNV-1a + XOR hashed hardcoded blocklist.(Citation: FireEye SUNBURST Additional Details Dec 2020)","relationship_id":"relationship--64ee123b-bf6f-440f-a34e-6f20838b6f30","references":[{"source_name":"FireEye SUNBURST Additional Details Dec 2020","description":"Stephen Eckels, Jay Smith, William Ballenthin. (2020, December 24). SUNBURST Additional Technical Details. Retrieved January 6, 2021.","url":"https://www.fireeye.com/blog/threat-research/2020/12/sunburst-additional-technical-details.html"}]},{"id":"S0576","name":"MegaCortex","url":"https://attack.mitre.org/software/S0576","kind":"malware","description":"[MegaCortex](https://attack.mitre.org/software/S0576) was used to kill endpoint security processes.(Citation: IBM MegaCortex)","relationship_id":"relationship--064b2c99-1f7c-43d5-ab3e-892e598e2cac","references":[{"source_name":"IBM MegaCortex","description":"Del Fierro, C. Kessem, L.. (2020, January 8). From Mega to Giga: Cross-Version Comparison of Top MegaCortex Modifications. Retrieved February 15, 2021.","url":"https://securityintelligence.com/posts/from-mega-to-giga-cross-version-comparison-of-top-megacortex-modifications/"}]},{"id":"S0579","name":"Waterbear","url":"https://attack.mitre.org/software/S0579","kind":"malware","description":"[Waterbear](https://attack.mitre.org/software/S0579) can hook the <code>ZwOpenProcess</code> and <code>GetExtendedTcpTable</code> APIs called by the process of a security product to hide PIDs and TCP records from detection.(Citation: Trend Micro Waterbear December 2019)","relationship_id":"relationship--f950da7f-1b35-48e5-9209-9fff55c3913f","references":[{"source_name":"Trend Micro Waterbear December 2019","description":"Su, V. et al. (2019, December 11). Waterbear Returns, Uses API Hooking to Evade Security. Retrieved February 22, 2021.","url":"https://www.trendmicro.com/en_us/research/19/l/waterbear-is-back-uses-api-hooking-to-evade-security-product-detection.html"}]},{"id":"S0583","name":"Pysa","url":"https://attack.mitre.org/software/S0583","kind":"malware","description":"[Pysa](https://attack.mitre.org/software/S0583) has the capability to stop antivirus services and disable Windows Defender.(Citation: CERT-FR PYSA April 2020) ","relationship_id":"relationship--5d0accb1-8889-4d96-9eb2-0258548c5b23","references":[{"source_name":"CERT-FR PYSA April 2020","description":"CERT-FR. (2020, April 1). ATTACKS INVOLVING THE MESPINOZA/PYSA RANSOMWARE. Retrieved March 1, 2021.","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-003.pdf"}]},{"id":"S0595","name":"ThiefQuest","url":"https://attack.mitre.org/software/S0595","kind":"malware","description":"[ThiefQuest](https://attack.mitre.org/software/S0595) uses the function <code>kill_unwanted</code> to obtain a list of running processes and kills each process matching a list of security related processes.(Citation: wardle evilquest parti)","relationship_id":"relationship--60827b66-e9a2-4da6-b589-492d3f7eebcd","references":[{"source_name":"wardle evilquest parti","description":"Patrick Wardle. (2020, June 29). OSX.EvilQuest Uncovered part i: infection, persistence, and more!. Retrieved March 18, 2021.","url":"https://objective-see.com/blog/blog_0x59.html"}]},{"id":"S0601","name":"Hildegard","url":"https://attack.mitre.org/software/S0601","kind":"malware","description":"[Hildegard](https://attack.mitre.org/software/S0601) has modified DNS resolvers to evade DNS monitoring tools.(Citation: Unit 42 Hildegard Malware)","relationship_id":"relationship--85301e49-dfb0-4dff-aa16-b76840c27515","references":[{"source_name":"Unit 42 Hildegard Malware","description":"Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.","url":"https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"}]},{"id":"S0603","name":"Stuxnet","url":"https://attack.mitre.org/software/S0603","kind":"malware","description":"[Stuxnet](https://attack.mitre.org/software/S0603) reduces the integrity level of objects to allow write actions.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)","relationship_id":"relationship--98cffbad-1538-44fa-b81e-49bad15e4e5c","references":[{"source_name":"Nicolas Falliere, Liam O Murchu, Eric Chien February 2011","description":"Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.","url":"https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"}]},{"id":"S0605","name":"EKANS","url":"https://attack.mitre.org/software/S0605","kind":"malware","description":"[EKANS](https://attack.mitre.org/software/S0605) stops processes related to security and management software.(Citation: Dragos EKANS)(Citation: FireEye Ransomware Feb 2020)","relationship_id":"relationship--fd6fb7c4-adce-4c66-8ac0-510e44273d9b","references":[{"source_name":"Dragos EKANS","description":"Dragos. (2020, February 3). EKANS Ransomware and ICS Operations. Retrieved February 9, 2021.","url":"https://www.dragos.com/blog/industry-news/ekans-ransomware-and-ics-operations/"},{"source_name":"FireEye Ransomware Feb 2020","description":"Zafra, D., et al. (2020, February 24). Ransomware Against the Machine: How Adversaries are Learning to Disrupt Industrial Production by Targeting IT and OT. Retrieved March 2, 2021.","url":"https://www.fireeye.com/blog/threat-research/2020/02/ransomware-against-machine-learning-to-disrupt-industrial-production.html"}]},{"id":"S0608","name":"Conficker","url":"https://attack.mitre.org/software/S0608","kind":"malware","description":"[Conficker](https://attack.mitre.org/software/S0608) terminates various services related to system security and Windows.(Citation: SANS Conficker)","relationship_id":"relationship--cd8095d6-6707-4963-badd-3f257e3245a6","references":[{"source_name":"SANS Conficker","description":"Burton, K. (n.d.). The Conficker Worm. Retrieved February 18, 2021.","url":"https://web.archive.org/web/20200125132645/https://www.sans.org/security-resources/malwarefaq/conficker-worm"}]},{"id":"S0611","name":"Clop","url":"https://attack.mitre.org/software/S0611","kind":"malware","description":"[Clop](https://attack.mitre.org/software/S0611) can uninstall or disable security products.(Citation: Cybereason Clop Dec 2020)","relationship_id":"relationship--efa0ed75-bb96-46e0-bf0b-84b6e4149542","references":[{"source_name":"Cybereason Clop Dec 2020","description":"Cybereason Nocturnus. (2020, December 23). Cybereason vs. Clop Ransomware. Retrieved May 11, 2021.","url":"https://www.cybereason.com/blog/cybereason-vs.-clop-ransomware"}]},{"id":"S0638","name":"Babuk","url":"https://attack.mitre.org/software/S0638","kind":"malware","description":"[Babuk](https://attack.mitre.org/software/S0638) can stop anti-virus services on a compromised host.(Citation: Sogeti CERT ESEC Babuk March 2021)","relationship_id":"relationship--0ae676ca-eb9c-4e3e-b577-22f63b42b7ca","references":[{"source_name":"Sogeti CERT ESEC Babuk March 2021","description":"Sogeti. (2021, March). Babuk Ransomware. Retrieved August 11, 2021.","url":"https://www.sogeti.com/globalassets/reports/cybersecchronicles_-_babuk.pdf"}]},{"id":"S0640","name":"Avaddon","url":"https://attack.mitre.org/software/S0640","kind":"malware","description":"[Avaddon](https://attack.mitre.org/software/S0640) looks for and attempts to stop anti-malware solutions.(Citation: Arxiv Avaddon Feb 2021)","relationship_id":"relationship--50a17d24-155e-4036-8a58-a8c376f36c05","references":[{"source_name":"Arxiv Avaddon Feb 2021","description":"Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.","url":"https://arxiv.org/pdf/2102.04796.pdf"}]},{"id":"S0650","name":"QakBot","url":"https://attack.mitre.org/software/S0650","kind":"malware","description":"[QakBot](https://attack.mitre.org/software/S0650) has the ability to modify the Registry to add its binaries to the Windows Defender exclusion list.(Citation: Group IB Ransomware September 2020)","relationship_id":"relationship--2a864dfa-14df-4e58-98a6-62cbc14b52f9","references":[{"source_name":"Group IB Ransomware September 2020","description":"Group IB. (2020, September). LOCK LIKE  A PRO. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20220119114433/https://groupib.pathfactory.com/ransomware-reports/prolock_wp"}]},{"id":"S0659","name":"Diavol","url":"https://attack.mitre.org/software/S0659","kind":"malware","description":"[Diavol](https://attack.mitre.org/software/S0659) can attempt to stop security software.(Citation: Fortinet Diavol July 2021)","relationship_id":"relationship--4ad6ce8b-4554-4b4f-b6d7-a049d2f83155","references":[{"source_name":"Fortinet Diavol July 2021","description":"Neeamni, D., Rubinfeld, A.. (2021, July 1). Diavol - A New Ransomware Used By Wizard Spider?. Retrieved November 12, 2021.","url":"https://www.fortinet.com/blog/threat-research/diavol-new-ransomware-used-by-wizard-spider"}]},{"id":"S0669","name":"KOCTOPUS","url":"https://attack.mitre.org/software/S0669","kind":"malware","description":"[KOCTOPUS](https://attack.mitre.org/software/S0669) will attempt to delete or disable all Registry keys and scheduled tasks related to Microsoft Security Defender and Security Essentials.(Citation: MalwareBytes LazyScripter Feb 2021)","relationship_id":"relationship--018f9809-0d5b-4a83-a712-2d605db13c59","references":[{"source_name":"MalwareBytes LazyScripter Feb 2021","description":"Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}]},{"id":"S0670","name":"WarzoneRAT","url":"https://attack.mitre.org/software/S0670","kind":"malware","description":"[WarzoneRAT](https://attack.mitre.org/software/S0670) can disarm Windows Defender during the UAC process to evade detection.(Citation: Check Point Warzone Feb 2020)","relationship_id":"relationship--1b61a1d1-c1e1-4fce-a84c-c1bccbf101fc","references":[{"source_name":"Check Point Warzone Feb 2020","description":"Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.","url":"https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/"}]},{"id":"S0688","name":"Meteor","url":"https://attack.mitre.org/software/S0688","kind":"malware","description":"[Meteor](https://attack.mitre.org/software/S0688) can attempt to uninstall Kaspersky Antivirus or remove the Kaspersky license; it can also add all files and folders related to the attack to the Windows Defender exclusion list.(Citation: Check Point Meteor Aug 2021)","relationship_id":"relationship--6941840a-027f-48af-a589-6ba29cddadfb","references":[{"source_name":"Check Point Meteor Aug 2021","description":"Check Point Research Team. (2021, August 14). Indra - Hackers Behind Recent Attacks on Iran. Retrieved February 17, 2022.","url":"https://research.checkpoint.com/2021/indra-hackers-behind-recent-attacks-on-iran/"}]},{"id":"S0689","name":"WhisperGate","url":"https://attack.mitre.org/software/S0689","kind":"malware","description":"[WhisperGate](https://attack.mitre.org/software/S0689) can download and execute AdvancedRun.exe to disable the Windows Defender Theat Protection service and set an exclusion path for the C:\\ drive.(Citation: Unit 42 WhisperGate January 2022)(Citation: Cisco Ukraine Wipers January 2022)(Citation: Medium S2W WhisperGate January 2022)","relationship_id":"relationship--15d6b855-c6c5-404b-8ab1-8dd5687784a0","references":[{"source_name":"Cisco Ukraine Wipers January 2022","description":"Biasini, N. et al.. (2022, January 21). Ukraine Campaign Delivers Defacement and Wipers, in Continued Escalation. Retrieved March 14, 2022.","url":"https://blog.talosintelligence.com/2022/01/ukraine-campaign-delivers-defacement.html"},{"source_name":"Unit 42 WhisperGate January 2022","description":"Falcone, R. et al.. (2022, January 20). Threat Brief: Ongoing Russia and Ukraine Cyber Conflict. Retrieved March 10, 2022.","url":"https://unit42.paloaltonetworks.com/ukraine-cyber-conflict-cve-2021-32648-whispergate/#whispergate-malware-family"},{"source_name":"Medium S2W WhisperGate January 2022","description":"S2W. (2022, January 18). Analysis of Destructive Malware (WhisperGate) targeting Ukraine. Retrieved March 14, 2022.","url":"https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3"}]},{"id":"S0692","name":"SILENTTRINITY","url":"https://attack.mitre.org/software/S0692","kind":"tool","description":"[SILENTTRINITY](https://attack.mitre.org/software/S0692)'s `amsiPatch.py` module can disable Antimalware Scan Interface (AMSI) functions.(Citation: GitHub SILENTTRINITY Modules July 2019)","relationship_id":"relationship--47bef4ea-597e-4827-b55f-c189aa67c928","references":[{"source_name":"GitHub SILENTTRINITY Modules July 2019","description":"Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.","url":"https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"}]},{"id":"S0695","name":"Donut","url":"https://attack.mitre.org/software/S0695","kind":"tool","description":"[Donut](https://attack.mitre.org/software/S0695) can patch Antimalware Scan Interface (AMSI), Windows Lockdown Policy (WLDP), as well as exit-related [Native API](https://attack.mitre.org/techniques/T1106) functions to avoid process termination.(Citation: Donut Github)\t","relationship_id":"relationship--ad52caca-b930-49ad-948c-4ffba6a70e1e","references":[{"source_name":"Donut Github","description":"TheWover. (2019, May 9). donut. Retrieved March 25, 2022.","url":"https://github.com/TheWover/donut"}]},{"id":"S0697","name":"HermeticWiper","url":"https://attack.mitre.org/software/S0697","kind":"malware","description":"[HermeticWiper](https://attack.mitre.org/software/S0697) has the ability to set the `HKLM:\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\CrashControl\\CrashDumpEnabled` Registry key to `0` in order to disable crash dumps.(Citation: SentinelOne Hermetic Wiper February 2022)(Citation: Crowdstrike DriveSlayer February 2022)(Citation: Qualys Hermetic Wiper March 2022)","relationship_id":"relationship--0e44aa81-e454-4274-9fba-07fe3d3e3a0c","references":[{"source_name":"SentinelOne Hermetic Wiper February 2022","description":"Guerrero-Saade, J. (2022, February 23). HermeticWiper | New Destructive Malware Used In Cyber Attacks on Ukraine. Retrieved March 25, 2022.","url":"https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack"},{"source_name":"Crowdstrike DriveSlayer February 2022","description":"Thomas, W. et al. (2022, February 25). CrowdStrike Falcon Protects from New Wiper Malware Used in Ukraine Cyberattacks. Retrieved March 25, 2022.","url":"https://www.crowdstrike.com/blog/how-crowdstrike-falcon-protects-against-wiper-malware-used-in-ukraine-attacks/"},{"source_name":"Qualys Hermetic Wiper March 2022","description":"Dani, M. (2022, March 1). Ukrainian Targets Hit by HermeticWiper, New Datawiper Malware. Retrieved March 25, 2022.","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/03/01/ukrainian-targets-hit-by-hermeticwiper-new-datawiper-malware"}]},{"id":"S1048","name":"macOS.OSAMiner","url":"https://attack.mitre.org/software/S1048","kind":"malware","description":"[macOS.OSAMiner](https://attack.mitre.org/software/S1048) has searched for the Activity Monitor process in the System Events process list and kills the process if running. [macOS.OSAMiner](https://attack.mitre.org/software/S1048) also searches the operating system's `install.log` for apps matching its hardcoded list, killing all matching process names.(Citation: SentinelLabs reversing run-only applescripts 2021)","relationship_id":"relationship--060fbd8f-3413-4bae-8a59-fe8de8bb1fb7","references":[{"source_name":"SentinelLabs reversing run-only applescripts 2021","description":"Phil Stokes. (2021, January 11). FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts. Retrieved September 29, 2022.","url":"https://www.sentinelone.com/labs/fade-dead-adventures-in-reversing-malicious-run-only-applescripts/"}]},{"id":"S1063","name":"Brute Ratel C4","url":"https://attack.mitre.org/software/S1063","kind":"tool","description":"[Brute Ratel C4](https://attack.mitre.org/software/S1063) has the ability to hide memory artifacts and to patch Event Tracing for Windows (ETW) and the Anti Malware Scan Interface (AMSI).(Citation: Palo Alto Brute Ratel July 2022)(Citation: MDSec Brute Ratel August 2022)","relationship_id":"relationship--84adaf9e-12f6-4c68-9ef6-a860715d0aaf","references":[{"source_name":"MDSec Brute Ratel August 2022","description":"Chell, D.  PART 3: How I Met Your Beacon – Brute Ratel. Retrieved February 6, 2023.","url":"https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/"},{"source_name":"Palo Alto Brute Ratel July 2022","description":"Harbison, M. and Renals, P. (2022, July 5). When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors. Retrieved February 1, 2023.","url":"https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/"}]},{"id":"S1065","name":"Woody RAT","url":"https://attack.mitre.org/software/S1065","kind":"malware","description":"[Woody RAT](https://attack.mitre.org/software/S1065) has suppressed all error reporting by calling `SetErrorMode` with 0x8007 as a parameter.(Citation: MalwareBytes WoodyRAT Aug 2022)","relationship_id":"relationship--b883f2f6-cb3d-4f49-ab42-1fe0b9362ff4","references":[{"source_name":"MalwareBytes WoodyRAT Aug 2022","description":"MalwareBytes Threat Intelligence Team. (2022, August 3). Woody RAT: A new feature-rich malware spotted in the wild. Retrieved December 6, 2022.","url":"https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild"}]},{"id":"S1097","name":"HUI Loader","url":"https://attack.mitre.org/software/S1097","kind":"malware","description":"[HUI Loader](https://attack.mitre.org/software/S1097) has the ability to disable Windows Event Tracing for Windows (ETW) and Antimalware Scan Interface (AMSI) functions.(Citation: SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022)","relationship_id":"relationship--b8f09e6e-b9f6-443e-8ac8-9cc69940f740","references":[{"source_name":"SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022","description":"Counter Threat Unit Research Team . (2022, June 23). BRONZE STARLIGHT RANSOMWARE OPERATIONS USE HUI LOADER. Retrieved December 7, 2023.","url":"https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader"}]},{"id":"S1111","name":"DarkGate","url":"https://attack.mitre.org/software/S1111","kind":"malware","description":"[DarkGate](https://attack.mitre.org/software/S1111) will terminate processes associated with several security software products if identified during execution.(Citation: Ensilo Darkgate 2018)","relationship_id":"relationship--271c15bb-8c7b-4d5b-8621-237eb04886ec","references":[{"source_name":"Ensilo Darkgate 2018","description":"Adi Zeligson & Rotem Kerner. (2018, November 13). Enter The DarkGate - New Cryptocurrency Mining and Ransomware Campaign. Retrieved February 9, 2024.","url":"https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"}]},{"id":"S1114","name":"ZIPLINE","url":"https://attack.mitre.org/software/S1114","kind":"malware","description":" [ZIPLINE](https://attack.mitre.org/software/S1114) can add itself to the exclusion list for the Ivanti Connect Secure Integrity Checker Tool if the `--exclude` parameter is passed by the `tar` process.(Citation: Mandiant Cutting Edge January 2024)","relationship_id":"relationship--f4666906-29a5-48ff-9f9a-2d0b4ad4fc45","references":[{"source_name":"Mandiant Cutting Edge January 2024","description":"McLellan, T. et al. (2024, January 12). Cutting Edge: Suspected APT Targets Ivanti Connect Secure VPN in New Zero-Day Exploitation. Retrieved February 27, 2024.","url":"https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"}]},{"id":"S1130","name":"Raspberry Robin","url":"https://attack.mitre.org/software/S1130","kind":"malware","description":"[Raspberry Robin](https://attack.mitre.org/software/S1130) can add an exception to Microsoft Defender that excludes the entire main drive from anti-malware scanning to evade detection.(Citation: HP RaspberryRobin 2024)","relationship_id":"relationship--0ae86b10-69a4-4e9d-9b31-403dc08be50f","references":[{"source_name":"HP RaspberryRobin 2024","description":"Patrick Schläpfer . (2024, April 10). Raspberry Robin Now Spreading Through Windows Script Files. Retrieved May 17, 2024.","url":"https://threatresearch.ext.hp.com/raspberry-robin-now-spreading-through-windows-script-files/"}]},{"id":"S1135","name":"MultiLayer Wiper","url":"https://attack.mitre.org/software/S1135","kind":"malware","description":"[MultiLayer Wiper](https://attack.mitre.org/software/S1135) removes the Volume Shadow Copy (VSS) service from infected devices along with all present shadow copies.(Citation: Unit42 Agrius 2023)","relationship_id":"relationship--ef571f47-693e-4bd8-9b39-5bd100a6e531","references":[{"source_name":"Unit42 Agrius 2023","description":"Or Chechik, Tom Fakterman, Daniel Frank & Assaf Dahan. (2023, November 6). Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors. Retrieved May 22, 2024.","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}]},{"id":"S1169","name":"Mango","url":"https://attack.mitre.org/software/S1169","kind":"malware","description":"[Mango](https://attack.mitre.org/software/S1169) contains an unused capability to block endpoint security solutions from loading user-mode code hooks via a DLL in a specified process by using the `UpdateProcThreadAttribute API` to set the `PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY` to `PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON` for an identified process. (Citation: ESET OilRig Campaigns Sep 2023)","relationship_id":"relationship--808fd295-d2d2-4284-bcc8-789221e18723","references":[{"source_name":"ESET OilRig Campaigns Sep 2023","description":"Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.","url":"https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"}]},{"id":"S1178","name":"ShrinkLocker","url":"https://attack.mitre.org/software/S1178","kind":"malware","description":"[ShrinkLocker](https://attack.mitre.org/software/S1178) disables protectors used to secure the BitLocker encryption key on victim systems.(Citation: Kaspersky ShrinkLocker 2024)(Citation: Splunk ShrinkLocker 2024)","relationship_id":"relationship--bc9ba7ad-2bcb-40e1-8ade-37d03aad8e81","references":[{"source_name":"Kaspersky ShrinkLocker 2024","description":"Cristian Souza, Eduardo Ovalle, Ashley Muñoz, & Christopher Zachor. (2024, May 23). ShrinkLocker: Turning BitLocker into ransomware. Retrieved December 7, 2024.","url":"https://securelist.com/ransomware-abuses-bitlocker/112643/"},{"source_name":"Splunk ShrinkLocker 2024","description":"Splunk Threat Research Team , Teoderick Contreras. (2024, September 5). ShrinkLocker Malware: Abusing BitLocker to Lock Your Data. Retrieved December 7, 2024.","url":"https://www.splunk.com/en_us/blog/security/shrinklocker-malware-abusing-bitlocker-to-lock-your-data.html"}]},{"id":"S1180","name":"BlackByte Ransomware","url":"https://attack.mitre.org/software/S1180","kind":"malware","description":"[BlackByte Ransomware](https://attack.mitre.org/software/S1180) adds .JS and .EXE extensions to the Microsoft Defender exclusion list. [BlackByte Ransomware](https://attack.mitre.org/software/S1180) terminates and removes the Raccine anti-ransomware utility.(Citation: Trustwave BlackByte 2021)","relationship_id":"relationship--9fa5ea79-2064-4a07-903b-b00987ac2c8a","references":[{"source_name":"Trustwave BlackByte 2021","description":"Rodel Mendrez & Lloyd Macrohon. (2021, October 15). BlackByte Ransomware – Pt. 1 In-depth Analysis. Retrieved December 16, 2024.","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/"}]},{"id":"S1184","name":"BOLDMOVE","url":"https://attack.mitre.org/software/S1184","kind":"malware","description":"[BOLDMOVE](https://attack.mitre.org/software/S1184) can disable the Fortinet daemons `moglogd` and `syslogd` to evade detection and logging.(Citation: Google Cloud BOLDMOVE 2023)","relationship_id":"relationship--d1fd41fe-4cac-4bd1-8bca-4193da673ba3","references":[{"source_name":"Google Cloud BOLDMOVE 2023","description":"Scott Henderson, Cristiana Kittner, Sarah Hawley & Mark Lechtik, Google Cloud. (2023, January 19). Suspected Chinese Threat Actors Exploiting FortiOS Vulnerability (CVE-2022-42475). Retrieved December 31, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/chinese-actors-exploit-fortios-flaw/"}]},{"id":"S1199","name":"LockBit 2.0","url":"https://attack.mitre.org/software/S1199","kind":"malware","description":"[LockBit 2.0](https://attack.mitre.org/software/S1199) can disable firewall rules and anti-malware and monitoring software including Windows Defender.(Citation: FBI Lockbit 2.0 FEB 2022)(Citation: Palo Alto Lockbit 2.0 JUN 2022)","relationship_id":"relationship--36f687d3-8052-4009-836d-8b796a1fcf71","references":[{"source_name":"Palo Alto Lockbit 2.0 JUN 2022","description":"Elsad, A. et al. (2022, June 9). LockBit 2.0: How This RaaS Operates and How to Protect Against It. Retrieved January 24, 2025.","url":"https://unit42.paloaltonetworks.com/lockbit-2-ransomware/"},{"source_name":"FBI Lockbit 2.0 FEB 2022","description":"FBI. (2022, February 4). Indicators of Compromise Associated with LockBit 2.0 Ransomware. Retrieved January 24, 2025.","url":"https://www.ic3.gov/CSA/2022/220204.pdf"}]},{"id":"S1200","name":"StealBit","url":"https://attack.mitre.org/software/S1200","kind":"malware","description":"[StealBit](https://attack.mitre.org/software/S1200) can configure processes to not display certain Windows error messages by through use of the `NtSetInformationProcess`.(Citation: Cybereason StealBit Exfiltration Tool)","relationship_id":"relationship--d28f8ff7-5dfc-4113-a4bf-cdb0ea1e5812","references":[{"source_name":"Cybereason StealBit Exfiltration Tool","description":"Cybereason Global SOC Team. (n.d.). THREAT ANALYSIS REPORT: Inside the LockBit Arsenal - The StealBit Exfiltration Tool. Retrieved January 29, 2025.","url":"https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool"}]},{"id":"S1202","name":"LockBit 3.0","url":"https://attack.mitre.org/software/S1202","kind":"malware","description":"[LockBit 3.0](https://attack.mitre.org/software/S1202) can disable security tools to evade detection including Windows Defender.(Citation: Joint Cybersecurity Advisory LockBit JUN 2023)(Citation: Joint Cybersecurity Advisory LockBit 3.0 MAR 2023)(Citation: INCIBE-CERT LockBit MAR 2024)","relationship_id":"relationship--5baaca5c-6f5b-4cbf-9bef-2f6625ec9e3f","references":[{"source_name":"Joint Cybersecurity Advisory LockBit JUN 2023","description":"CISA et al. (2023, June 14). UNDERSTANDING RANSOMWARE THREAT ACTORS: LOCKBIT. Retrieved February 5, 2025.","url":"https://www.cisa.gov/sites/default/files/2023-06/aa23-165a_understanding_TA_LockBit_0.pdf"},{"source_name":"Joint Cybersecurity Advisory LockBit 3.0 MAR 2023","description":"FBI et al. (2023, March 16). #StopRansomware: LockBit 3.0. Retrieved February 5, 2025.","url":"https://www.cisa.gov/sites/default/files/2023-03/aa23-075a-stop-ransomware-lockbit.pdf"},{"source_name":"INCIBE-CERT LockBit MAR 2024","description":"INCIBE-CERT. (2024, March 14). LockBit: response and recovery actions. Retrieved February 5, 2025.","url":"https://www.incibe.es/en/incibe-cert/blog/lockbit-response-and-recovery-actions"}]},{"id":"S1206","name":"JumbledPath","url":"https://attack.mitre.org/software/S1206","kind":"malware","description":"[JumbledPath](https://attack.mitre.org/software/S1206) can impair logging on all devices used along its connection path to compromised hosts.(Citation: Cisco Salt Typhoon FEB 2025)","relationship_id":"relationship--41bf2d1e-85e1-47a0-82ac-11deda6927e3","references":[{"source_name":"Cisco Salt Typhoon FEB 2025","description":"Cisco Talos. (2025, February 20). Weathering the storm: In the midst of a Typhoon. Retrieved February 24, 2025.","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/"}]},{"id":"S1207","name":"XLoader","url":"https://attack.mitre.org/software/S1207","kind":"malware","description":"[XLoader](https://attack.mitre.org/software/S1207) loads a copy of NTDLL to evade hooks from security monitoring tools on this library.(Citation: Zscaler XLoader 2025) [XLoader](https://attack.mitre.org/software/S1207) can add the path of its executable to the Microsoft Defender exclusion list.(Citation: Netskope XLoader 2022)","relationship_id":"relationship--1b68d2aa-a5b2-4d6b-b063-3609ce13e810","references":[{"source_name":"Netskope XLoader 2022","description":"Gustavo Palazolo, Netskope. (2022, March 11). New Formbook Campaign Delivered Through Phishing Emails. Retrieved March 11, 2025.","url":"https://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails"},{"source_name":"Zscaler XLoader 2025","description":"Zscaler Threatlabz. (2025, January 27). Technical Analysis of Xloader Versions 6 and 7 | Part 1. Retrieved March 11, 2025.","url":"https://www.zscaler.com/blogs/security-research/technical-analysis-xloader-versions-6-and-7-part-1"}]},{"id":"S1213","name":"Lumma Stealer","url":"https://attack.mitre.org/software/S1213","kind":"malware","description":"[Lumma Stealer](https://attack.mitre.org/software/S1213) has attempted to bypass Windows Antimalware Scan Interface (AMSI) by removing the string “AmsiScanBuffer” from the “clr.dll” module in memory to prevent it from being called.(Citation: Netskope LummaStealer 2025)","relationship_id":"relationship--74474695-0959-42a8-8352-e70486d066f4","references":[{"source_name":"Netskope LummaStealer 2025","description":"Leandro Fróes, Netskope. (2025, January 23). Lumma Stealer: Fake CAPTCHAs & New Techniques to Evade Detection. Retrieved March 22, 2025.","url":"https://www.netskope.com/blog/lumma-stealer-fake-captchas-new-techniques-to-evade-detection"}]},{"id":"S1234","name":"SplatCloak","url":"https://attack.mitre.org/software/S1234","kind":"malware","description":"[SplatCloak](https://attack.mitre.org/software/S1234) has identified and disabled API callback features of Windows Defender and Kaspersky.(Citation: Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025)","relationship_id":"relationship--021e01e6-7694-48f2-b35f-5862178bc05c","references":[{"source_name":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","description":"Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2. Retrieved September 12, 2025.","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"}]},{"id":"S1240","name":"RedLine Stealer","url":"https://attack.mitre.org/software/S1240","kind":"malware","description":"[RedLine Stealer](https://attack.mitre.org/software/S1240) can disable security software and update services.(Citation: Splunk RedLine Stealer June 2023)","relationship_id":"relationship--1eb7d0a2-784b-44e8-a1dd-2c444b67bf29","references":[{"source_name":"Splunk RedLine Stealer June 2023","description":"Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.","url":"https://www.splunk.com/en_us/blog/security/do-not-cross-the-redline-stealer-detections-and-analysis.html"}]},{"id":"S1242","name":"Qilin","url":"https://attack.mitre.org/software/S1242","kind":"malware","description":"[Qilin](https://attack.mitre.org/software/S1242) can terminate antivirus-related processes and services.(Citation: Trend Micro Agenda Ransomware AUG 2022)(Citation: SentinelOne Qilin NOV 2022)(Citation: Halcyon Qilin.B OCT 2024)(Citation: Picus Qilin MAR 2025)\n\n","relationship_id":"relationship--dbe9c675-61d0-43c3-ad77-6c511fdc46b9","references":[{"source_name":"Picus Qilin MAR 2025","description":"Hacioglu, S. (2025, March 10). Qilin Ransomware: Exposing the TTPs Behind One of the Most Active Ransomware Campaigns of 2024. Retrieved September 26, 2025.","url":"https://www.picussecurity.com/resource/blog/qilin-ransomware"},{"source_name":"Halcyon Qilin.B OCT 2024","description":"Halcyon RISE Team. (2024, October 24). New Qilin.B Ransomware Variant Boasts Enhanced Encryption and Defense Evasion. Retrieved September 26, 2025.","url":"https://www.halcyon.ai/blog/new-qilin-b-ransomware-variant-boasts-enhanced-encryption-and-defense-evasion"},{"source_name":"Trend Micro Agenda Ransomware AUG 2022","description":"Magdy, S. et al. (2022, August 25). New Golang Ransomware Agenda Customizes Attacks. Retrieved September 26, 2025.","url":"https://www.trendmicro.com/en_us/research/22/h/new-golang-ransomware-agenda-customizes-attacks.html"},{"source_name":"SentinelOne Qilin NOV 2022","description":"SentinelOne. (2022, November 30). Agenda (Qilin). Retrieved September 26, 2025.","url":"https://www.sentinelone.com/anthology/agenda-qilin/"}]},{"id":"S1244","name":"Medusa Ransomware","url":"https://attack.mitre.org/software/S1244","kind":"malware","description":"[Medusa Ransomware](https://attack.mitre.org/software/S1244) has terminated antivirus services utilizing the gaze.exe executable.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024) [Medusa Ransomware](https://attack.mitre.org/software/S1244) has also terminated antivirus services utilizing PowerShell scripts.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)(Citation: Security Scorecard Medusa Ransomware January 2024)","relationship_id":"relationship--e1c8ddae-74d1-41f2-a7ee-d0ab379d54c8","references":[{"source_name":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","description":"Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source_name":"Security Scorecard Medusa Ransomware January 2024","description":"Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}]},{"id":"S9008","name":"Shai-Hulud","url":"https://attack.mitre.org/software/S9008","kind":"malware","description":"[Shai-Hulud](https://attack.mitre.org/software/S9008) has replaced DNS configuration from `/tmp/resolved.conf` in order to gain control of network-level control within CI environments and has flushed iptables rules using `sudo iptables -F OUTPUT` and `sudo iptables -F DOCKER-USER`.(Citation: Socket Shai-Hulud November 2025)","relationship_id":"relationship--4321e96d-8a92-498c-9b7a-b134cd8cb7a9","references":[{"source_name":"Socket Shai-Hulud November 2025","description":"Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.","url":"https://socket.dev/blog/shai-hulud-strikes-again-v2"}]},{"id":"S9013","name":"DRYHOOK","url":"https://attack.mitre.org/software/S9013","kind":"malware","description":"[DRYHOOK](https://attack.mitre.org/software/S9013) has killed all instances of the `cgi-server` process in order for the modified Perl module to be activated.(Citation: Google UNC5221 Ivanti January 2025)","relationship_id":"relationship--92bb51a3-92f3-42d0-9af4-5d56ca60a830","references":[{"source_name":"Google UNC5221 Ivanti January 2025","description":"John Wolfram, Josh Murchie, Matt Lin, Daniel Ainsworth, Robert Wallace, Dimiter Andonov, Dhanesh Kizhakkinan, Jacob Thompson. (2025, January 8). Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation. Retrieved April 14, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day"}]},{"id":"S9014","name":"PHASEJAM","url":"https://attack.mitre.org/software/S9014","kind":"malware","description":"[PHASEJAM](https://attack.mitre.org/software/S9014) has modified Ivanti Connect Secure appliances and blocks the system upgrades by altering the DSUpgrade.pm file.(Citation: Google UNC5221 Ivanti January 2025)","relationship_id":"relationship--b5e67d75-31f0-4cdd-a75d-17a32b455dde","references":[{"source_name":"Google UNC5221 Ivanti January 2025","description":"John Wolfram, Josh Murchie, Matt Lin, Daniel Ainsworth, Robert Wallace, Dimiter Andonov, Dhanesh Kizhakkinan, Jacob Thompson. (2025, January 8). Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation. Retrieved April 14, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day"}]},{"id":"S9017","name":"DCRAT","url":"https://attack.mitre.org/software/S9017","kind":"tool","description":"[DCRAT](https://attack.mitre.org/software/S9017) can patch Microsoft’s Antimalware Scan Interface (AMSI) to evade detection.(Citation: Zscaler BlindEagle DEC 2025)","relationship_id":"relationship--c90b713d-1c0d-4b74-acf9-43644d08c52e","references":[{"source_name":"Zscaler BlindEagle DEC 2025","description":"Pellegrino, G. (2025, December 16). BlindEagle Targets Colombian Government Agency with Caminho and DCRAT. Retrieved April 16, 2026.","url":"https://www.zscaler.com/blogs/security-research/blindeagle-targets-colombian-government-agency-caminho-and-dcrat"}]},{"id":"S9019","name":"PureCrypter","url":"https://attack.mitre.org/software/S9019","kind":"malware","description":"[PureCrypter](https://attack.mitre.org/software/S9019) has executed `Set-MpPreference -ExclusionPath` to exclude files or folders from Windows Defender scans.(Citation: Zscaler PureCrypter JUN 2022)","relationship_id":"relationship--3c1b9608-a67a-4db6-adbc-ea24cca581ba","references":[{"source_name":"Zscaler PureCrypter JUN 2022","description":"Dumont, R. (2022, June 13). Technical Analysis of PureCrypter: A Fully-Functional Loader Distributing Remote Access Trojans and Information Stealers. Retrieved April 16, 2026.","url":"https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter"}]},{"id":"S9024","name":"SPAWNCHIMERA","url":"https://attack.mitre.org/software/S9024","kind":"malware","description":"[SPAWNCHIMERA](https://attack.mitre.org/software/S9024) has modified the Ivanti Integrity Checker Tool to evade detection.(Citation: CISA SPAWNCHIMERA RESURGE February 2026)(Citation: Picus Security UNC5221 Ivanti May 2025)","relationship_id":"relationship--f03fd4ac-f8c5-4904-a973-62b863a418f9","references":[{"source_name":"CISA SPAWNCHIMERA RESURGE February 2026","description":"DHS/CISA. (2026, February 26). MAR-25993211-r1.v2 Ivanti Connect Secure (RESURGE): AR25-087A. Retrieved April 17, 2026.","url":"https://www.cisa.gov/news-events/analysis-reports/ar25-087a"},{"source_name":"Picus Security UNC5221 Ivanti May 2025","description":"Sila Ozeren Hacioglu. (2025, May 5). UNC5221’s Latest Exploit: Weaponizing CVE-2025-22457 in Ivanti Connect Secure. Retrieved April 13, 2026.","url":"https://www.picussecurity.com/resource/blog/unc5221-cve-2025-22457-ivanti-connect-secure"}]},{"id":"S9039","name":"LazyWiper","url":"https://attack.mitre.org/software/S9039","kind":"malware","description":"[LazyWiper](https://attack.mitre.org/software/S9039) can disable Microsoft Windows Defender Real-Time Monitoring with the `Set-MpPreference` cmdlet.(Citation: CERT Polska)  ","relationship_id":"relationship--2d480202-6883-4c91-b734-767370a6d121","references":[{"source_name":"CERT Polska","description":"CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.","url":"https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"}]},{"id":"S9050","name":"Vidar","url":"https://attack.mitre.org/software/S9050","kind":"malware","description":"[Vidar](https://attack.mitre.org/software/S9050) has modified Windows Defender’s list of excluded file extensions, ensuring that .exe, .dll and .bat files are ignored during scans.(Citation: Logpoint_StealerMalwareFamilies_2024) \n\n[Vidar](https://attack.mitre.org/software/S9050) has loaded amsi.dll, which resolves the `AmsiScanBuffer` variable to return `E_INVALIDARG`, which may disable Windows Antimalware Scan Interface (AMSI).(Citation: Unit42_Vidar_July2026)","relationship_id":"relationship--cc3e8998-6bb1-4e18-a2a4-f4ae1ccba3fe","references":[{"source_name":"Logpoint_StealerMalwareFamilies_2024","description":"Khadgi, N. (n.d.). A Comprehensive Overview on Stealer Malware Families. Retrieved August 25, 2026.","url":"https://web.archive.org/web/20240517205011/https://www.logpoint.com/wp-content/uploads/2024/03/logpoint-etpr-a-comprehensive-overview-on-stealer-malware-families-1.pdf"},{"source_name":"Unit42_Vidar_July2026","description":"Nannaka, B., Chhaparwal, P. (2026, July 7). Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation. Retrieved July 8, 2026.","url":"https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/"}]},{"id":"S9051","name":"The Gentlemen Ransomware","url":"https://attack.mitre.org/software/S9051","kind":"malware","description":"[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has disabled Microsoft Defender utilizing PowerShell commands to include the cmdlet `Set-MpPreference -DisableRealtimeMonitoring $true -Force`.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: TrendAI_TheGentlemen_Sept2025)(Citation: CheckPointResearch_TheGentlemen_April2026)(Citation: CarveyODonnellWelchHuntress_TheGentlemen_May2026) [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has also utilized the `TaskKill` command to target specific processes associated with backup software, endpoint detection, and office applications.(Citation: TrendAI_TheGentlemen_Sept2025)(Citation: CheckPointResearch_TheGentlemen_April2026)","relationship_id":"relationship--ebf22611-e216-4b97-8b8b-04e59c928b95","references":[{"source_name":"CarveyODonnellWelchHuntress_TheGentlemen_May2026","description":"Carvey, H., O'Donnell-Welch, L. (2026, May 21). The Gentlemen (Ransomware) in Disguise: Defense Evasion and other TTPs. Retrieved September 18, 2026.","url":"https://www.huntress.com/blog/the-gentlemen-ransomware-defense-evasion-ttps"},{"source_name":"CheckPointResearch_TheGentlemen_April2026","description":"Check Point Research. (2026, April 20). DFIR Report – The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy. Retrieved September 18, 2026.","url":"https://research.checkpoint.com/2026/dfir-report-the-gentlemen/"},{"source_name":"MSTI_GentelmenRansomware_May2026","description":"Microsoft Threat Intelligence. (2026, May 28). The Gentlemen ransomware: Dissecting a self-propagating Go encryptor . Retrieved September 18, 2026.","url":"https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/"},{"source_name":"TrendAI_TheGentlemen_Sept2025","description":"Santos, J., et al. (2025, September 9). Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures Revealed . Retrieved September 18, 2026.","url":"https://www.trendaisecurity.com/en-us/resources-insights/trendai-security-blog/unmasking-the-gentlemen-ransomware"}]}],"actors":[{"id":"G0010","name":"Turla","url":"https://attack.mitre.org/groups/G0010","kind":"intrusion-set","description":"[Turla](https://attack.mitre.org/groups/G0010) has used a AMSI bypass, which patches the in-memory amsi.dll, in PowerShell scripts to bypass Windows antimalware products.(Citation: ESET Turla PowerShell May 2019)","relationship_id":"relationship--6e067a3e-21a7-4a68-ac82-60b7ea325a5d","references":[{"source_name":"ESET Turla PowerShell May 2019","description":"Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"}]},{"id":"G0024","name":"Putter Panda","url":"https://attack.mitre.org/groups/G0024","kind":"intrusion-set","description":"Malware used by [Putter Panda](https://attack.mitre.org/groups/G0024) attempts to terminate processes corresponding to two components of Sophos Anti-Virus (SAVAdminService.exe and SavService.exe).(Citation: CrowdStrike Putter Panda)","relationship_id":"relationship--5adb2d01-8616-4413-8a3f-7cb4d2749284","references":[{"source_name":"CrowdStrike Putter Panda","description":"Crowdstrike Global Intelligence Team. (2014, June 9). CrowdStrike Intelligence Report: Putter Panda. Retrieved January 22, 2016.","url":"http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf"}]},{"id":"G0032","name":"Lazarus Group","url":"https://attack.mitre.org/groups/G0032","kind":"intrusion-set","description":"[Lazarus Group](https://attack.mitre.org/groups/G0032) malware TangoDelta attempts to terminate various processes associated with McAfee. Additionally, [Lazarus Group](https://attack.mitre.org/groups/G0032) malware SHARPKNOT disables the Microsoft Windows System Event Notification and Alerter services.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Loaders)(Citation: Novetta Blockbuster Tools)(Citation: US-CERT SHARPKNOT June 2018). ","relationship_id":"relationship--6f08abbe-2b04-482f-98ec-ae9382ba3084","references":[{"source_name":"Novetta Blockbuster Loaders","description":"Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Loaders, Installers and Uninstallers Report. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source_name":"Novetta Blockbuster Tools","description":"Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Tools Report. Retrieved March 10, 2016.","url":"https://web.archive.org/web/20220425194457/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"},{"source_name":"Novetta Blockbuster","description":"Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"US-CERT SHARPKNOT June 2018","description":"US-CERT. (2018, March 09). Malware Analysis Report (MAR) - 10135536.11.WHITE. Retrieved June 13, 2018.","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf"}]},{"id":"G0037","name":"FIN6","url":"https://attack.mitre.org/groups/G0037","kind":"intrusion-set","description":"[FIN6](https://attack.mitre.org/groups/G0037) has deployed a utility script named <code>kill.bat</code> to disable anti-virus.(Citation: FireEye FIN6 Apr 2019)","relationship_id":"relationship--15ade855-78be-4131-bf28-349573613447","references":[{"source_name":"FireEye FIN6 Apr 2019","description":"McKeague, B. et al. (2019, April 5). Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware. Retrieved April 17, 2019.","url":"https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html"}]},{"id":"G0047","name":"Gamaredon Group","url":"https://attack.mitre.org/groups/G0047","kind":"intrusion-set","description":"[Gamaredon Group](https://attack.mitre.org/groups/G0047) has delivered macros which can tamper with Microsoft Office security settings.(Citation: ESET Gamaredon June 2020)(Citation: ESET Gamaredon Sept2024) \t","relationship_id":"relationship--7da2fa27-ae11-4955-9dff-b2e2d24d6548","references":[{"source_name":"ESET Gamaredon June 2020","description":"Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source_name":"ESET Gamaredon Sept2024","description":"Rusnák, Z. (2024, September 26). Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023. Retrieved October 30, 2024.","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"}]},{"id":"G0059","name":"Magic Hound","url":"https://attack.mitre.org/groups/G0059","kind":"intrusion-set","description":"[Magic Hound](https://attack.mitre.org/groups/G0059) has disabled antivirus services on targeted systems in order to upload malicious payloads.(Citation: DFIR Report APT35 ProxyShell March 2022)","relationship_id":"relationship--f9344ac5-2c8d-4ed8-af5a-62b52cec5f09","references":[{"source_name":"DFIR Report APT35 ProxyShell March 2022","description":"DFIR Report. (2022, March 21). APT35 Automates Initial Access Using ProxyShell. Retrieved May 25, 2022.","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"}]},{"id":"G0060","name":"BRONZE BUTLER","url":"https://attack.mitre.org/groups/G0060","kind":"intrusion-set","description":"[BRONZE BUTLER](https://attack.mitre.org/groups/G0060) has incorporated code into several tools that attempts to terminate anti-virus processes.(Citation: Trend Micro Tick November 2019)","relationship_id":"relationship--6471e2c1-621f-4393-a63f-c6cfbacc592e","references":[{"source_name":"Trend Micro Tick November 2019","description":"Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"id":"G0069","name":"MuddyWater","url":"https://attack.mitre.org/groups/G0069","kind":"intrusion-set","description":"[MuddyWater](https://attack.mitre.org/groups/G0069) can disable the system's local proxy settings.(Citation: Trend Micro Muddy Water March 2021)","relationship_id":"relationship--778d26cc-c730-4329-aa66-8c7e83610e99","references":[{"source_name":"Trend Micro Muddy Water March 2021","description":"Peretz, A. and Theck, E. (2021, March 5). Earth Vetala – MuddyWater Continues to Target Organizations in the Middle East. Retrieved March 18, 2021.","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"}]},{"id":"G0078","name":"Gorgon Group","url":"https://attack.mitre.org/groups/G0078","kind":"intrusion-set","description":"[Gorgon Group](https://attack.mitre.org/groups/G0078) malware can attempt to disable security features in Microsoft Office and Windows Defender using the <code>taskkill</code> command.(Citation: Unit 42 Gorgon Group Aug 2018)","relationship_id":"relationship--0b926b38-f00a-4ea2-a64b-8b4c05851629","references":[{"source_name":"Unit 42 Gorgon Group Aug 2018","description":"Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/"}]},{"id":"G0082","name":"APT38","url":"https://attack.mitre.org/groups/G0082","kind":"intrusion-set","description":"[APT38](https://attack.mitre.org/groups/G0082) has unhooked DLLs to disable endpoint detection and response (EDR) or anti-virus (AV) tools.(Citation: 1 - appv) ","relationship_id":"relationship--57e05fbc-ffbc-4110-a58f-02c5e8813b14","references":[{"source_name":"1 - appv","description":"SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.","url":"https://securelist.com/bluenoroff-methods-bypass-motw/108383/"}]},{"id":"G0092","name":"TA505","url":"https://attack.mitre.org/groups/G0092","kind":"intrusion-set","description":"[TA505](https://attack.mitre.org/groups/G0092) has used malware to disable Windows Defender.(Citation: Korean FSI TA505 2020)","relationship_id":"relationship--eac7af33-0dd4-48aa-a78b-8c422ea3e482","references":[{"source_name":"Korean FSI TA505 2020","description":"Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.","url":"https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="}]},{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) has been observed turning off Windows Security Center and can hide the AV software window from the view of the infected user.(Citation: Securelist Kimsuky Sept 2013)(Citation: Talos Kimsuky Nov 2021)","relationship_id":"relationship--0a6e9719-3f53-4d8e-b540-89cff763e361","references":[{"source_name":"Talos Kimsuky Nov 2021","description":"An, J and Malhotra, A. (2021, November 10). North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets. Retrieved December 29, 2021.","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source_name":"Securelist Kimsuky Sept 2013","description":"Tarakanov , D.. (2013, September 11). The “Kimsuky” Operation: A North Korean APT?. Retrieved August 13, 2019.","url":"https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"}]},{"id":"G0096","name":"APT41","url":"https://attack.mitre.org/groups/G0096","kind":"intrusion-set","description":"[APT41](https://attack.mitre.org/groups/G0096) developed a custom injector that enables an Event Tracing for Windows (ETW) bypass, making malicious processes invisible to Windows logging.(Citation: Rostovcev APT41 2021)","relationship_id":"relationship--644bf221-89ce-48b8-abe9-eaadf1ee8ff4","references":[{"source_name":"Rostovcev APT41 2021","description":"Nikita Rostovcev. (2022, August 18). APT41 World Tour 2021 on a tight schedule. Retrieved February 22, 2024.","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"}]},{"id":"G0102","name":"Wizard Spider","url":"https://attack.mitre.org/groups/G0102","kind":"intrusion-set","description":"[Wizard Spider](https://attack.mitre.org/groups/G0102) has shut down or uninstalled security applications on victim systems that might prevent ransomware from executing.(Citation: DHS/CISA Ransomware Targeting Healthcare October 2020)(Citation: FireEye KEGTAP SINGLEMALT October 2020)(Citation: DFIR Ryuk's Return October 2020)(Citation: Mandiant FIN12 Oct 2021)","relationship_id":"relationship--61a16f5b-29c2-4d75-bf4f-36228fe68016","references":[{"source_name":"DHS/CISA Ransomware Targeting Healthcare October 2020","description":"DHS/CISA. (2020, October 28). Ransomware Activity Targeting the Healthcare and Public Health Sector. Retrieved October 28, 2020.","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-302a"},{"source_name":"FireEye KEGTAP SINGLEMALT October 2020","description":"Kimberly Goody, Jeremy Kennelly, Joshua Shilko, Steve Elovitz, Douglas Bienstock. (2020, October 28). Unhappy Hour Special: KEGTAP and SINGLEMALT With a Ransomware Chaser. Retrieved October 28, 2020.","url":"https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"},{"source_name":"Mandiant FIN12 Oct 2021","description":"Shilko, J., et al. (2021, October 7). FIN12: The Prolific Ransomware Intrusion Threat Actor That Has Aggressively Pursued Healthcare Targets. Retrieved June 15, 2023.","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"},{"source_name":"DFIR Ryuk's Return October 2020","description":"The DFIR Report. (2020, October 8). Ryuk’s Return. Retrieved October 9, 2020.","url":"https://thedfirreport.com/2020/10/08/ryuks-return/"}]},{"id":"G0106","name":"Rocke","url":"https://attack.mitre.org/groups/G0106","kind":"intrusion-set","description":"[Rocke](https://attack.mitre.org/groups/G0106) used scripts which detected and uninstalled antivirus software.(Citation: Talos Rocke August 2018)(Citation: Unit 42 Rocke January 2019)","relationship_id":"relationship--edea1ba7-228e-49db-a340-081c0e207495","references":[{"source_name":"Talos Rocke August 2018","description":"Liebenberg, D.. (2018, August 30). Rocke: The Champion of Monero Miners. Retrieved May 26, 2020.","url":"https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"},{"source_name":"Unit 42 Rocke January 2019","description":"Xingyu, J.. (2019, January 17). Malware Used by Rocke Group Evolves to Evade Detection by Cloud Security Products. Retrieved May 26, 2020.","url":"https://unit42.paloaltonetworks.com/malware-used-by-rocke-group-evolves-to-evade-detection-by-cloud-security-products/"}]},{"id":"G0119","name":"Indrik Spider","url":"https://attack.mitre.org/groups/G0119","kind":"intrusion-set","description":"[Indrik Spider](https://attack.mitre.org/groups/G0119) used [PsExec](https://attack.mitre.org/software/S0029) to leverage Windows Defender to disable scanning of all downloaded files and to restrict real-time monitoring.(Citation: Symantec WastedLocker June 2020) [Indrik Spider](https://attack.mitre.org/groups/G0119) has used `MpCmdRun` to revert the definitions in Microsoft Defender.(Citation: Mandiant_UNC2165) Additionally, [Indrik Spider](https://attack.mitre.org/groups/G0119) has used WMI to stop or uninstall and reset anti-virus products and other defensive services.(Citation: Mandiant_UNC2165)","relationship_id":"relationship--4d6e2596-a7ed-49af-b24b-dca2ddbb6ef2","references":[{"source_name":"Mandiant_UNC2165","description":"Mandiant Intelligence. (2022, June 2). To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions. Retrieved July 29, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/"},{"source_name":"Symantec WastedLocker June 2020","description":"Symantec Threat Intelligence. (2020, June 25). WastedLocker: Symantec Identifies Wave of Attacks Against U.S. Organizations. Retrieved May 20, 2021.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us"}]},{"id":"G0139","name":"TeamTNT","url":"https://attack.mitre.org/groups/G0139","kind":"intrusion-set","description":"[TeamTNT](https://attack.mitre.org/groups/G0139) has disabled and uninstalled security tools such as Alibaba, Tencent, and BMC cloud monitoring agents on cloud-based infrastructure.(Citation: ATT TeamTNT Chimaera September 2020)(Citation: Cisco Talos Intelligence Group)","relationship_id":"relationship--ca720b2b-b8f2-471e-a5a5-b786bb084d83","references":[{"source_name":"ATT TeamTNT Chimaera September 2020","description":"AT&T Alien Labs. (2021, September 8). TeamTNT with new campaign aka Chimaera. Retrieved September 22, 2021.","url":"https://cybersecurity.att.com/blogs/labs-research/teamtnt-with-new-campaign-aka-chimaera"},{"source_name":"Cisco Talos Intelligence Group","description":"Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022.","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"}]},{"id":"G0143","name":"Aquatic Panda","url":"https://attack.mitre.org/groups/G0143","kind":"intrusion-set","description":"[Aquatic Panda](https://attack.mitre.org/groups/G0143) has attempted to stop endpoint detection and response (EDR) tools on compromised systems.(Citation: CrowdStrike AQUATIC PANDA December 2021)","relationship_id":"relationship--95ba226b-11a7-441e-ba6f-2d4f243dffdd","references":[{"source_name":"CrowdStrike AQUATIC PANDA December 2021","description":"Wiley, B. et al. (2021, December 29). OverWatch Exposes AQUATIC PANDA in Possession of Log4Shell Exploit Tools During Hands-on Intrusion Attempt. Retrieved January 18, 2022.","url":"https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/"}]},{"id":"G1015","name":"Scattered Spider","url":"https://attack.mitre.org/groups/G1015","kind":"intrusion-set","description":"[Scattered Spider](https://attack.mitre.org/groups/G1015) has uninstalled and disabled security tools.(Citation: Mandiant UNC3944 May 2025) ","relationship_id":"relationship--07aa4a45-85f6-4ec6-b079-389d29c44108","references":[{"source_name":"Mandiant UNC3944 May 2025","description":"Mandiant Incident Response. (2025, May 6). Defending Against UNC3944: Cybercrime Hardening Guidance from the Frontlines. Retrieved October 13, 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations"}]},{"id":"G1018","name":"TA2541","url":"https://attack.mitre.org/groups/G1018","kind":"intrusion-set","description":"[TA2541](https://attack.mitre.org/groups/G1018)  has attempted to disable built-in security protections such as Windows AMSI. (Citation: Proofpoint TA2541 February 2022)","relationship_id":"relationship--38e9a261-d427-4c06-999f-8679795556ef","references":[{"source_name":"Proofpoint TA2541 February 2022","description":"Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.","url":"https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"}]},{"id":"G1023","name":"APT5","url":"https://attack.mitre.org/groups/G1023","kind":"intrusion-set","description":"[APT5](https://attack.mitre.org/groups/G1023) has used the CLEANPULSE utility to insert command line strings into a targeted process to prevent certain log events from occurring.(Citation: Mandiant Pulse Secure Update May 2021)","relationship_id":"relationship--37915015-f4c2-48be-9a98-e846c37baedc","references":[{"source_name":"Mandiant Pulse Secure Update May 2021","description":"Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]},{"id":"G1024","name":"Akira","url":"https://attack.mitre.org/groups/G1024","kind":"intrusion-set","description":"[Akira](https://attack.mitre.org/groups/G1024) has disabled or modified security tools for defense evasion.(Citation: Cisco Akira Ransomware OCT 2024)","relationship_id":"relationship--daf8822d-3f33-4c18-8472-4da8a1b6d5ad","references":[{"source_name":"Cisco Akira Ransomware OCT 2024","description":"Nutland, J. and Szeliga, M. (2024, October 21). Akira ransomware continues to evolve. Retrieved December 10, 2024.","url":"https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve/"}]},{"id":"G1030","name":"Agrius","url":"https://attack.mitre.org/groups/G1030","kind":"intrusion-set","description":"[Agrius](https://attack.mitre.org/groups/G1030) used several mechanisms to try to disable security tools. [Agrius](https://attack.mitre.org/groups/G1030) attempted to modify EDR-related services to disable auto-start on system reboot. [Agrius](https://attack.mitre.org/groups/G1030) used a publicly available driver, <code>GMER64.sys</code> typically used for anti-rootkit functionality, to selectively stop and remove security software processes.(Citation: Unit42 Agrius 2023)","relationship_id":"relationship--25fca6d7-bea3-4987-a7cb-65739b2c4850","references":[{"source_name":"Unit42 Agrius 2023","description":"Or Chechik, Tom Fakterman, Daniel Frank & Assaf Dahan. (2023, November 6). Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors. Retrieved May 22, 2024.","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}]},{"id":"G1031","name":"Saint Bear","url":"https://attack.mitre.org/groups/G1031","kind":"intrusion-set","description":"[Saint Bear](https://attack.mitre.org/groups/G1031) will modify registry entries and scheduled task objects associated with Windows Defender to disable its functionality.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )","relationship_id":"relationship--59af5f32-5099-48cd-bf84-73ab69ef052d","references":[{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","description":"Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}]},{"id":"G1032","name":"INC Ransom","url":"https://attack.mitre.org/groups/G1032","kind":"intrusion-set","description":"[INC Ransom](https://attack.mitre.org/groups/G1032) can use SystemSettingsAdminFlows.exe, a native Windows utility, to disable Windows Defender.(Citation: Huntress INC Ransomware May 2024)","relationship_id":"relationship--9024716a-189b-4e2d-b58e-ae9b0cd111ec","references":[{"source_name":"Huntress INC Ransomware May 2024","description":"Carvey, H. (2024, May 1). LOLBin to INC Ransomware. Retrieved June 5, 2024.","url":"https://www.huntress.com/blog/lolbin-to-inc-ransomware"}]},{"id":"G1040","name":"Play","url":"https://attack.mitre.org/groups/G1040","kind":"intrusion-set","description":"\n[Play](https://attack.mitre.org/groups/G1040) has used tools including GMER, IOBit, and PowerTool to disable antivirus software.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)\n","relationship_id":"relationship--fb4e6ac6-49db-43ae-a595-5e1c1c3ad6ec","references":[{"source_name":"CISA Play Ransomware Advisory December 2023","description":"CISA. (2023, December 18). #StopRansomware: Play Ransomware AA23-352A. Retrieved September 24, 2024.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a"},{"source_name":"Trend Micro Ransomware Spotlight Play July 2023","description":"Trend Micro Research. (2023, July 21). Ransomware Spotlight: Play. Retrieved September 24, 2024.","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}]},{"id":"G1043","name":"BlackByte","url":"https://attack.mitre.org/groups/G1043","kind":"intrusion-set","description":"[BlackByte](https://attack.mitre.org/groups/G1043) disabled security tools such as Windows Defender and the Raccine anti-ransomware tool during operations.(Citation: FBI BlackByte 2022)(Citation: Picus BlackByte 2022)(Citation: Cisco BlackByte 2024)","relationship_id":"relationship--417d46c4-2fed-4722-81dd-5f936787d2db","references":[{"source_name":"Picus BlackByte 2022","description":"Huseyin Can Yuceel. (2022, February 21). TTPs used by BlackByte Ransomware Targeting Critical Infrastructure. Retrieved December 16, 2024.","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source_name":"Cisco BlackByte 2024","description":"James Nutland, Craig Jackson, Terryn Valikodath, & Brennan Evans. (2024, August 28). BlackByte blends tried-and-true tradecraft with newly disclosed vulnerabilities to support ongoing attacks. Retrieved December 16, 2024.","url":"https://blog.talosintelligence.com/blackbyte-blends-tried-and-true-tradecraft-with-newly-disclosed-vulnerabilities-to-support-ongoing-attacks/"},{"source_name":"FBI BlackByte 2022","description":"US Federal Bureau of Investigation & US Secret Service. (2022, February 11). Indicators of Compromise Associated with BlackByte Ransomware. Retrieved December 16, 2024.","url":"https://www.ic3.gov/CSA/2022/220211.pdf"}]},{"id":"G1045","name":"Salt Typhoon","url":"https://attack.mitre.org/groups/G1045","kind":"intrusion-set","description":"[Salt Typhoon](https://attack.mitre.org/groups/G1045) has disabled logging and disabled the distribution of logs to log aggregators.(Citation: CISA_AA25-239ASaltTyphoon_Sept2025)","relationship_id":"relationship--dad97f94-ac0e-43a1-bfd8-983132a0f1c0","references":[{"source_name":"CISA_AA25-239ASaltTyphoon_Sept2025","description":"CISA. (2025, September 3). Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System. Retrieved September 22, 2026.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a"}]},{"id":"G1047","name":"Velvet Ant","url":"https://attack.mitre.org/groups/G1047","kind":"intrusion-set","description":"[Velvet Ant](https://attack.mitre.org/groups/G1047) attempted to disable local security tools and endpoint detection and response (EDR) software during operations.(Citation: Sygnia VelvetAnt 2024A)","relationship_id":"relationship--a9901579-54a9-407a-ab28-6aa9befc978f","references":[{"source_name":"Sygnia VelvetAnt 2024A","description":"Sygnia Team. (2024, June 3). China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence. Retrieved March 14, 2025.","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}]},{"id":"G1048","name":"UNC3886","url":"https://attack.mitre.org/groups/G1048","kind":"intrusion-set","description":"[UNC3886](https://attack.mitre.org/groups/G1048) has disabled OpenSSL digital signature verification of system files through corruption of boot files.(Citation: Mandiant Fortinet Zero Day)","relationship_id":"relationship--907b4dbb-83e2-4357-aee8-9bcabc2feb96","references":[{"source_name":"Mandiant Fortinet Zero Day","description":"Marvi, A. et al.. (2023, March 16). Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation. Retrieved March 22, 2023.","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}]},{"id":"G1051","name":"Medusa Group","url":"https://attack.mitre.org/groups/G1051","kind":"intrusion-set","description":"[Medusa Group](https://attack.mitre.org/groups/G1051) has terminated antivirus services utilizing the gaze.exe executable and utilizing `psexec.exe`.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)(Citation: CISA Medusa Group Medusa Ransomware March 2025)(Citation: Broadcom Medusa Ransomware Medusa Group March 2025) [Medusa Group](https://attack.mitre.org/groups/G1051) has also leveraged I/O control codes (IOCTLs) for terminating and deleting processes of identified security tools.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)","relationship_id":"relationship--e9027e50-c7dc-4bba-b19b-cd402c00b99c","references":[{"source_name":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","description":"Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source_name":"CISA Medusa Group Medusa Ransomware March 2025","description":"Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source_name":"Broadcom Medusa Ransomware Medusa Group March 2025","description":"Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"}]},{"id":"G1052","name":"Contagious Interview","url":"https://attack.mitre.org/groups/G1052","kind":"intrusion-set","description":"[Contagious Interview](https://attack.mitre.org/groups/G1052) has convinced victims to disable Docker and other container environments and run code on their machine natively in attempts to bypass container isolation and ensure device infection.(Citation: Socket HexEval BeaverTail Contagious Interview June 2025)","relationship_id":"relationship--4e7b9e53-2cd3-47c0-b08a-b5ed52a20df7","references":[{"source_name":"Socket HexEval BeaverTail Contagious Interview June 2025","description":"Kirill Boychenko. (2025, June 25). Another Wave: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages. Retrieved October 19, 2025.","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"}]},{"id":"G1054","name":"MirrorFace","url":"https://attack.mitre.org/groups/G1054","kind":"intrusion-set","description":"[MirrorFace](https://attack.mitre.org/groups/G1054) has disabled Windows Defender in compromised environments.(Citation: JPCERT MirrorFace JUL 2024)","relationship_id":"relationship--1ccfc450-d4a7-464d-aa95-f2dddf2f9652","references":[{"source_name":"JPCERT MirrorFace JUL 2024","description":"Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"}]}],"mitigations":[{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Ensure proper user permissions are in place to prevent adversaries from disabling or interfering with security services.","relationship_id":"relationship--1b61ec0f-6c86-4d0c-ae02-7b2fb32754a7","references":[]},{"id":"M1022","name":"Restrict File and Directory Permissions","url":"https://attack.mitre.org/mitigations/M1022","kind":"course-of-action","description":"Ensure proper process and file permissions are in place to prevent adversaries from disabling or interfering with security services.","relationship_id":"relationship--4cc1fe6e-b097-4e81-b0c3-aee729ec9600","references":[]},{"id":"M1024","name":"Restrict Registry Permissions","url":"https://attack.mitre.org/mitigations/M1024","kind":"course-of-action","description":"Ensure proper Registry permissions are in place to prevent adversaries from disabling or interfering with security services.","relationship_id":"relationship--a2a81edb-693e-416d-b42d-671c950d88d7","references":[]},{"id":"M1038","name":"Execution Prevention","url":"https://attack.mitre.org/mitigations/M1038","kind":"course-of-action","description":"Use application control where appropriate, especially regarding the execution of tools outside of the organization's security policies (such as rootkit removal tools) that have been abused to impair system defenses. Ensure that only approved security applications are used and running on enterprise systems.","relationship_id":"relationship--8724cdb9-066b-41bf-ab71-57f375fbda43","references":[]},{"id":"M1042","name":"Disable or Remove Feature or Program","url":"https://attack.mitre.org/mitigations/M1042","kind":"course-of-action","description":"Consider removing previous versions of tools that are unnecessary to the environment when possible.","relationship_id":"relationship--4f313b03-22ae-4789-aef2-12121e9f717d","references":[]},{"id":"M1047","name":"Audit","url":"https://attack.mitre.org/mitigations/M1047","kind":"course-of-action","description":"Periodically verify that tools are functioning appropriately – for example, that all expected hosts with EDRs or monitoring agents are checking in to the central console. Check EDRs to ensure that no unexpected exclusion paths have been added. In Microsoft Defender for Endpoint, exclusions can be reviewed with the `Get-MpPreference` cmdlet.(Citation: CodeX Microsoft Defender 2021)","relationship_id":"relationship--4b564cd9-d1c8-4f9d-b922-b6a651497edc","references":[{"source_name":"CodeX Microsoft Defender 2021","description":"Christopher Brumm. (2021, August 4). My learnings on Microsoft Defender for Endpoint and Exclusions. Retrieved March 18, 2025.","url":"https://medium.com/codex/my-learnings-on-microsoft-defender-for-endpoint-and-exclusions-ddacf2fdd047"}]},{"id":"M1054","name":"Software Configuration","url":"https://attack.mitre.org/mitigations/M1054","kind":"course-of-action","description":"Consider automatically relaunching forwarding mechanisms at recurring intervals (ex: temporal, on-logon, etc.) as well as applying appropriate change management to firewall rules and other related system configurations.","relationship_id":"relationship--568ce97a-d845-41a3-828a-49b372fa46d6","references":[]}],"candidates":[{"id":"07f43b33-1e15-4e99-be70-bc094157c849","name":"Disable OpenDNS Umbrella","platforms":["macos"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Disables OpenDNS Umbrella\n","inputs":{},"dependencies":[],"source_definition_sha256":"84ebaf106efd75d030440ccc9e7f696b5415372dce93dcd5e92851bcbed3512d"},{"id":"091a6290-cd29-41cb-81ea-b12f133c66cb","name":"ESXi - Disable Account Lockout Policy via PowerCLI","platforms":["linux"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"An adversary may disable account lockout policy within ESXi to have the ability to prevent defensive actions from being enforced in the future or to prevent future alerting.\n","inputs":{"vm_host":{"description":"Specify the host name of the ESXi Server","type":"string","default":"atomic.local"},"vm_user":{"description":"Specify the privilege user account on ESXi Server","type":"string","default":"root"},"vm_pass":{"description":"Specify the privilege user password on ESXi Server","type":"string","default":"pass"}},"dependencies":[{"description":"Check if VMWARE PowerCLI PowerShell Module is installed.\n"}],"source_definition_sha256":"c1ab28dbc59707abf89d5cf3392ab97fafbcc04b635c102096563a6281657a13"},{"id":"0b19f4ee-de90-4059-88cb-63c800c683ed","name":"Tamper with Windows Defender Evade Scanning -Folder","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Malware can exclude a specific path from being scanned and evading detection. \nUpon successul execution, the file provided should be on the list of excluded path. \nTo check the exclusion list using poweshell (Get-MpPreference).ExclusionPath \n","inputs":{"excluded_folder":{"description":"This folder will be excluded from scanning","type":"path","default":"C:\\Temp"}},"dependencies":[],"source_definition_sha256":"f6574459b372243db78a49c34a610386b29681bdea1db0e208c4baf06056faf0"},{"id":"0e7b8a4b-2ca5-4743-a9f9-96051abb6e50","name":"Delete Microsoft Defender ASR Rules - GPO","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"This test simulates the deletion of the ASR rules loaded by Microsoft Defender using the registry. Depending on the deployment, rules can be pushed either using GPO or InTune, This test simulates a GPO-based rules deployment.","inputs":{},"dependencies":[],"source_definition_sha256":"cdc4e418f86cab2620d9a83321555147d587bd3e68bec84e42b5c87a5b1f009c"},{"id":"110b4281-43fe-405f-a184-5d8eaf228ebf","name":"Disable .NET Event Tracing for Windows Via Environment Variable HKLM Registry - Cmd","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Disables ETW for the .NET Framework by setting the COMPlus_ETWEnabled environment variable to 0 in the HKLM registry using the reg.exe utility. In order for changes to take effect a reboot might be required.","inputs":{},"dependencies":[],"source_definition_sha256":"d91cbb7b975dddee16f023e887316f0e57be31af3e082bf66ee43dac9f65760f"},{"id":"1174b5df-2c33-490f-8854-f5eb80c907ca","name":"Block Cybersecurity communication by leveraging Windows Name Resolution Policy Table","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Adversaries are redirecting DNS queries to an incorrect or malicious DNS server IP, thereby blocking legitimate communications and potentially compromising the security infrastructure. This atomic test aims to respond with 127.0.0.1 when a DNS query is made for endpoint.security.microsoft.com.","inputs":{},"dependencies":[],"source_definition_sha256":"d0875d3d74fbfe262fdc1da6aa661c37e7fd49f6e3d49af674af694349272a4f"},{"id":"11e65d8d-e7e4-470e-a3ff-82bc56ad938e","name":"AWS - GuardDuty Suspension or Deletion","platforms":["iaas:aws"],"method":"automated","executor":"bash","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Enables GuardDuty in AWS, upon successful creation this test will suspend and then delete the GuardDuty configuration.\n","inputs":{"region":{"description":"Name of the specified region","type":"string","default":"us-east-1"}},"dependencies":[{"description":"Check if ~/.aws/credentials file has a default stanza is configured\n"}],"source_definition_sha256":"99696300687f1415e12d42a637c3cc969302c0e109f1bba8c4b17e6cc842b056"},{"id":"12e5551c-8d5c-408e-b3e4-63f53b03379f","name":"Disable journal logging via sed utility","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"The atomic test disables the journal logging by searching and replacing the \"Storage\" parameter to \"none\" within the journald.conf file, thus any new journal entries will only be temporarily available in memory and not written to disk\n","inputs":{},"dependencies":[],"source_definition_sha256":"91fd89f0446ab1b116d1d95640fc5c1376461c477b0688dd1cd5b60f717d5fa4"},{"id":"13f09b91-c953-438e-845b-b585e51cac9b","name":"AMSI Bypass - Remove AMSI Provider Reg Key","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"With administrative rights, an adversary can remove the AMSI Provider registry key in HKLM\\Software\\Microsoft\\AMSI to disable AMSI inspection.\nThis test removes the Windows Defender provider registry key. Upon execution, no output is displayed.\nOpen Registry Editor and navigate to \"HKLM:\\SOFTWARE\\Microsoft\\AMSI\\Providers\\\" to verify that it is gone.\n","inputs":{},"dependencies":[],"source_definition_sha256":"7d4c768766093f881277a8b8290fda66451110681704aaddaa5283843c2e613b"},{"id":"17538258-5699-4ff1-92d1-5ac9b0dc21f5","name":"AMSI Bypass - Override AMSI via COM","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"With administrative rights, an adversary can disable AMSI via registry value in HKCU\\Software\\Classes\\CLSID\\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} by overriding the Microsoft Defender COM object for AMSI and points it to a DLL that does not exist.\nThis is currently being used by AsyncRAT and others. \nhttps://strontic.github.io/xcyclopedia/library/clsid_fdb00e52-a214-4aa1-8fba-4357bb0072ec.html\nhttps://securitynews.sonicwall.com/xmlpost/asyncrat-variant-includes-cryptostealer-capabilites/\n","inputs":{},"dependencies":[],"source_definition_sha256":"d30fe58f2b1282f272b9c0f2b68fa2844237a88f8707152d9d7fc4b68e535d5d"},{"id":"19c07a45-452d-4620-90ed-4c34fffbe758","name":"Disable .NET Event Tracing for Windows Via Registry (powershell)","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Disables ETW for the .NET Framework using PowerShell to update the Windows registry","inputs":{},"dependencies":[],"source_definition_sha256":"4b755d427839ebd82862119132b712429205cc4e95fae5164ffd65d294b2760b"},{"id":"1b3e0146-a1e5-4c5c-89fb-1bb2ffe8fc45","name":"Tamper with Windows Defender Registry","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Disable Windows Defender from starting after a reboot. Upen execution, if the computer is rebooted the entire Virus and Threat protection window in Settings will be\ngrayed out and have no info.\n","inputs":{},"dependencies":[],"source_definition_sha256":"40d98d1d732fc56c8bd00645e82c9e1ff835ce15eb2cb37870286c8f001544bb"},{"id":"1cac9b54-810e-495c-8aac-989e0076583b","name":"Disable EventLog-Application ETW Provider Via Registry - Cmd","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"This atomic simulates an activity where an attacker disables a specific ETW provider from the EventLog-Application ETW Auto Logger session using the reg.exe utility to update the Windows registry value \"Enabled\". This would effectivly remove that provider from the session and cause to not emit any logs of that type. The changes would only take effect after a restart.","inputs":{"ETWProviderGUID":{"type":"string","default":"{B6D775EF-1436-4FE6-BAD3-9E436319E218}","description":"Microsoft-Windows-SenseIR ETW Provider GUID"}},"dependencies":[],"source_definition_sha256":"227409b2e68a2dd5bad5181b42139fee6d0aa8e55bceafca5d422ddee6187b35"},{"id":"1f6743da-6ecc-4a93-b03f-dc357e4b313f","name":"Tamper with Windows Defender Registry - Reg.exe","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Disable Windows Defender by tampering with windows defender registry using the utility \"reg.exe\"\n","inputs":{},"dependencies":[],"source_definition_sha256":"844e66437d17326e2cc952da71cf9d9007842cc39cfb1ea9905e2a944291d6fd"},{"id":"212cfbcf-4770-4980-bc21-303e37abd0e3","name":"Auditing Configuration Changes on Linux Host","platforms":["linux"],"method":"automated","executor":"bash","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Emulates modification of auditd configuration files\n","inputs":{"audisp_config_file_name":{"description":"The name of the audispd configuration file to be changed","type":"string","default":"audispd.conf"},"auditd_config_file_name":{"description":"The name of the auditd configuration file to be changed","type":"string","default":"auditd.conf"},"libaudit_config_file_name":{"description":"The name of the libaudit configuration file to be changed","type":"string","default":"libaudit.conf"}},"dependencies":[],"source_definition_sha256":"cd15d899e4366d612c39b8e0c23ad2f1eb9c0986ec5452960f1d95d15021c61c"},{"id":"23b88394-091b-4968-a42d-fb8076992443","name":"Clear History","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Clear Shell History. This technique only affect the bash shell application. \n","inputs":{},"dependencies":[],"source_definition_sha256":"8f0434957c9c49bd1b1c315b1fa38ec0b6267686ab8bc3673f7f2c8dd5fc14da"},{"id":"24a12b91-05a7-4deb-8d7f-035fa98591bc","name":"Kill antimalware protected processes using Backstab","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Backstab loads Process Explorer driver which is signed by Microsoft and use it to terminate running processes protected by antimalware software such as MsSense.exe or MsMpEng.exe, which is otherwise not possible to kill.\nhttps://github.com/Yaxser/Backstab","inputs":{"process_name":{"description":"Name of the protected process you want to kill/terminate.","type":"string","default":"MsMpEng.exe"}},"dependencies":[{"description":"Backstab64.exe should exist in ExtrnalPayloads Directory"}],"source_definition_sha256":"be42a10d0e7949f8a3c9b5d5cd195a38203ed6fcad9219c7c6635efeffdc3279"},{"id":"2a821573-fb3f-4e71-92c3-daac7432f053","name":"Disable macOS Gatekeeper","platforms":["macos"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Disables macOS Gatekeeper\n","inputs":{},"dependencies":[],"source_definition_sha256":"febf55837fa62083d0525c168a58b92936a8fecfb85f6749744da1212ab9875a"},{"id":"315f4be6-2240-4552-b3e1-d1047f5eecea","name":"Tamper with Windows Defender Evade Scanning -Extension","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Malware can exclude specific extensions from being scanned and evading detection. \nUpon successful execution, the extension(s) should be on the list of excluded extensions.\nTo check the exclusion list using poweshell  (Get-MpPreference).ExclusionExtension.\n","inputs":{"excluded_exts":{"description":"A list of extension to exclude from scanning","type":"string","default":".exe"}},"dependencies":[],"source_definition_sha256":"8a48284060e878a7653c7818abe3b58e9a1d58117961e2d72dd69617c22f47ba"},{"id":"3d47daaa-2f56-43e0-94cc-caf5d8d52a68","name":"Remove Windows Defender Definition Files","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Removing definition files would cause ATP to not fire for AntiMalware. Check MpCmdRun.exe man page for info on all arguments.\nOn later viersions of windows (1909+) this command fails even with admin due to inusfficient privelages. On older versions of windows the\ncommand will say completed.\n\nhttps://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/\n","inputs":{},"dependencies":[],"source_definition_sha256":"f0383fc20878996c8cb72a56c8106451709d2eb1d540e7496780056178a80a80"},{"id":"40074085-dbc8-492b-90a3-11bcfc52fda8","name":"Tamper with Defender ATP on Linux/MacOS","platforms":["linux","macos"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"With root privileges, an adversary can disable real time protection. Note, this test assumes Defender is not in passive mode and real-time protection is enabled. The use of a managed.json on Linux or Defender .plist on MacOS will prevent these changes. Tamper protection will also prevent this (available on MacOS, but not Linux at the time of writing). Installation of MDATP is a prerequisite. Installation steps vary across MacOS and Linux distros. See Microsoft public documentation for instructions: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/mac-install-manually?view=o365-worldwide https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/linux-install-manually?view=o365-worldwide\n","inputs":{},"dependencies":[],"source_definition_sha256":"bf95a131a98d3ffac7564a213a18abc71a116cd4c75d95b53af91d727c234d00"},{"id":"40075d5f-3a70-4c66-9125-f72bee87247d","name":"Windows Disable LSA Protection","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"The following Atomic adds a registry entry to disable LSA Protection.\n\nThe LSA controls and manages user rights information, password hashes and other important bits of information in memory. Attacker tools, such as mimikatz, rely on accessing this content to scrape password hashes or clear-text passwords. Enabling LSA Protection configures Windows to control the information stored in memory in a more secure fashion - specifically, to prevent non-protected processes from accessing that data.\nUpon successful execution, the registry will be modified and RunAsPPL will be set to 0, disabling Lsass protection.\nhttps://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection#how-to-disable-lsa-protection\nhttps://blog.netwrix.com/2022/01/11/understanding-lsa-protection/\nhttps://thedfirreport.com/2022/03/21/phosphorus-automates-initial-access-using-proxyshell/  \n","inputs":{},"dependencies":[],"source_definition_sha256":"6f0178bf869dc4892c71fee35c63889fb46e5c06fe32f4225086d11f2533729a"},{"id":"4b841aa1-0d05-4b32-bbe7-7564346e7c76","name":"Delete Windows Defender Scheduled Tasks","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"The following atomic test will delete the Windows Defender scheduled tasks.\n\n[Reference](https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/)\n","inputs":{},"dependencies":[{"description":"The Windows Defender scheduled tasks must be backed up first\n"}],"source_definition_sha256":"ca50ee7a159c3917c387947e9574c1acd794a32ebfe70ba6e80e8ac72c6df9c3"},{"id":"4ce786f8-e601-44b5-bfae-9ebb15a7d1c8","name":"Disable syslog","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Disables syslog collection\n","inputs":{"package_checker":{"description":"Package checking command for linux.","type":"string","default":"(rpm -q rsyslog 2>&1 >/dev/null) || (dpkg -s rsyslog | grep -q installed)"},"package_installer":{"description":"Package installer command for linux. Default yum","type":"string","default":"(which yum && yum -y install epel-release rsyslog)||(which apt-get && apt-get install -y rsyslog)"},"flavor_command":{"description":"Command to disable syslog collection. Default newer rsyslog commands. i.e older command = service rsyslog stop ; chkconfig off rsyslog","type":"string","default":"systemctl stop rsyslog ; systemctl disable rsyslog"},"cleanup_command":{"description":"Command to enable syslog collection. Default newer rsyslog commands. i.e older command = service rsyslog start ; chkconfig rsyslog on","type":"string","default":"systemctl start rsyslog ; systemctl enable rsyslog"}},"dependencies":[{"description":"Package with rsyslog must be on system\n"}],"source_definition_sha256":"a7102a0319e9ebe783472a607d2b73302fd0b40d47c7bb0a09a49726e09466fe"},{"id":"4d61779d-be7f-425c-b560-0cafb2522911","name":"Disable .NET Event Tracing for Windows Via Environment Variable HKLM Registry - PowerShell","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Disables ETW for the .NET Framework by setting the COMPlus_ETWEnabled environment variable to 0 in the HKLM registry using PowerShell. In order for changes to take effect a reboot might be required.","inputs":{},"dependencies":[],"source_definition_sha256":"107cba8f78a7d5e439f1225e5ee50b1278e8a27ff1d6f6b28f945dc7e7e9f975"},{"id":"59d386fc-3a4b-41b8-850d-9e3eee24dfe4","name":"WMIC Tamper with Windows Defender Evade Scanning Folder","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"The following Atomic will attempt to exclude a folder within Defender leveraging WMI\nReference: https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/\n","inputs":{},"dependencies":[],"source_definition_sha256":"389a64828edad785946a27a4e63e58f60a48bf8c40223de2cb71f5a887424a2f"},{"id":"5e27f36d-5132-4537-b43b-413b0d5eec9a","name":"Lockbit Black - Use Registry Editor to turn on automatic logon -Powershell","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Lockbit Black - Use Registry Editor to turn on automatic logon\n","inputs":{},"dependencies":[],"source_definition_sha256":"3c2e8698bfa8e4300aac3338bfc39608fb32bffbef9a4464a8ab648c5270d51c"},{"id":"62155dd8-bb3d-4f32-b31c-6532ff3ac6a3","name":"Disable LittleSnitch","platforms":["macos"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Disables LittleSnitch\n","inputs":{},"dependencies":[],"source_definition_sha256":"8f57dfdad4542eed644d8ec316873f9b2f49da2e031fd9ec695490b005c36194"},{"id":"653c6e17-14a2-4849-851d-f1c0cc8ea9ab","name":"Disable EventLog-Application Auto Logger Session Via Registry - Cmd","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"This atomic simulates an activity where an attacker disables the EventLog-Application ETW Auto Logger session using the reg.exe utility to update the Windows registry value \"Start\". This would effectivly disable the Event log application channel. The changes would only take effect after a restart.","inputs":{},"dependencies":[],"source_definition_sha256":"86042d81cb4619165e846b31a7826e38f930f37bcfc873b83f9081cd839bb06f"},{"id":"695eed40-e949-40e5-b306-b4031e4154bd","name":"AMSI Bypass - AMSI InitFailed","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Any easy way to bypass AMSI inspection is it patch the dll in memory setting the \"amsiInitFailed\" function to true.\nUpon execution, no output is displayed.\n\nhttps://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/\n","inputs":{},"dependencies":[],"source_definition_sha256":"79a64b393b6112d858d1a463dbc538018e5841835f1fcbd0d934b059a5c79d34"},{"id":"69fc085b-5444-4879-8002-b24c8e1a3e02","name":"LockBit Black - Disable the ETW Provider of Windows Defender -Powershell","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"An adversary can disable the ETW Provider of Windows Defender,\nso nothing would be logged to Microsoft-Windows-Windows-Defender/Operational anymore.\nhttps://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a\n","inputs":{},"dependencies":[],"source_definition_sha256":"0c5e3c6865101b4989f3686faf5595be9c4051816b4f40d93a9d6dc608fec2db"},{"id":"6b8ca3ab-5980-4321-80c3-bcd77c8daed8","name":"Logging Configuration Changes on FreeBSD Host","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Emulates modification of syslog configuration.\n","inputs":{"syslog_config_file_name":{"description":"The name of the syslog configuration file to be changed","type":"string","default":"syslog.conf"}},"dependencies":[],"source_definition_sha256":"99df0472e466f7eb75d424509b412296d3411eb04c290c416f77256f53034284"},{"id":"6b8df440-51ec-4d53-bf83-899591c9b5d7","name":"Tamper with Windows Defender ATP PowerShell","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Attempting to disable scheduled scanning and other parts of windows defender atp. Upon execution Virus and Threat Protection will show as disabled\nin Windows settings.\n","inputs":{},"dependencies":[],"source_definition_sha256":"1edeb662001a4ee33a5b7e4d62d37ea8650dfb5a3043da025c3d12d15979a298"},{"id":"6d6d3154-1a52-4d1a-9d51-92ab8148b32e","name":"Reboot Linux Host via Kernel System Request","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"reboot system via system request seen in Awfulshred wiper.\n","inputs":{},"dependencies":[],"source_definition_sha256":"143e8c435dbf8d9ba5c92c0d0fe490af65781be8773c0169b6210bc4b0e62f9c"},{"id":"6f118276-121d-4c09-bb58-a8fb4a72ee84","name":"Disable Powershell ETW Provider - Windows","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"This test was created to disable the Microsoft Powershell ETW provider by using the built-in Windows tool, logman.exe. This provider is used as a common source of telemetry in AV/EDR solutions.","inputs":{"ps_exec_location":{"description":"Location of PSExec.","type":"string","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\pstools\\PsExec.exe"},"session":{"description":"The session to disable.","type":"string","default":"EventLog-Application"},"provider":{"description":"The provider to disable.","type":"string","default":"Microsoft-Windows-Powershell"}},"dependencies":[{"description":"PSExec must be installed on the machine."}],"source_definition_sha256":"751ac5818dbbb27b2ec24b86b84e8b43ddfd85de83403eadd8eff57ad250a024"},{"id":"6f5fb61b-4e56-4a3d-a8c3-82e13686c6d7","name":"Disable Microsoft Office Security Features","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Gorgon group may disable Office security features so that their code can run. Upon execution, an external document will not\nshow any warning before editing the document.\n\n\nhttps://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/\n","inputs":{},"dependencies":[],"source_definition_sha256":"45b451b6093aa9df3581dfba5234ca68bb05a9d35fc6f4b7b996f83d81742bb6"},{"id":"70bd71e6-eba4-4e00-92f7-617911dbe020","name":"Disable Hypervisor-Enforced Code Integrity (HVCI)","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"This test disables Hypervisor-Enforced Code Integrity (HVCI) by setting the registry key HKLM:\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard\\Scenarios\\HypervisorEnforcedCodeIntegrity \"Enabled\" value to \"0\".\nThe pre-req needs to be ran in order to setup HVCI and have it enabled. \nWe do not recommend running this in production.\n[Black Lotus Campaign](https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/)\n[Microsoft](https://learn.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity)\n","inputs":{},"dependencies":[{"description":"HVCI must be enabled\n"}],"source_definition_sha256":"c6c623e33a73ceb249134e50b1e75db26b6d08f9fa8ae2f0ad2a3cc9e3f020b4"},{"id":"728eca7b-0444-4f6f-ac36-437e3d751dc0","name":"AMSI Bypass - Create AMSIEnable Reg Key","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Threat Actor could disable the AMSI function by adding a registry value name “AmsiEnable” to the registry key “HKCU\\Software\\Microsoft\\Windows Script\\Settings\\AmsiEnable” and set its value to 0.\nRef: https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d\n","inputs":{},"dependencies":[],"source_definition_sha256":"94ae355954928048e78f8e495e4b4574af7d8e6fb50eb122c53bd5ea541aa37f"},{"id":"7869d7a3-3a30-4d2c-a5d2-f1cd9c34ce66","name":"WinPwn - Kill the event log services for stealth","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Kill the event log services for stealth via function of WinPwn","inputs":{},"dependencies":[],"source_definition_sha256":"8c4257bd826b31d8aac581b8861b15bf4ba4914bab95fd949fcdbf62e8be8a1f"},{"id":"7d40bc58-94c7-4fbb-88d9-ebce9fcdb60c","name":"Logging Configuration Changes on Linux Host","platforms":["linux"],"method":"automated","executor":"bash","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Emulates modification of syslog configuration.\n","inputs":{"syslog_config_file_name":{"description":"The name of the syslog configuration file to be changed","type":"string","default":"syslog.conf"},"rsyslog_config_file_name":{"description":"The name of the rsyslog configuration file to be changed","type":"string","default":"rsyslog.conf"},"syslog_ng_config_file_name":{"description":"The name of the syslog-ng configuration file to be changed","type":"string","default":"syslog-ng.conf"}},"dependencies":[],"source_definition_sha256":"2be5b4e128b4a71ea96f28a9da684ba3edee48d1cd2eec536da482325e8298a4"},{"id":"7dd05b3e-0803-4852-9345-c494eb3e40fe","name":"Throttle Cybersecurity Agent Network Traffic via QoS Policy","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"This test simulates an adversary impairing security agent capabilities by applying Policy-Based Quality of Service (QoS) throttling rules to security agent processes.\n\nUnlike traditional evasion techniques (such as firewall-based blocking or process termination), this approach leverages native Windows functionality to degrade, rather than disable, defensive tooling:\n\n- Uses built-in Windows QoS features to manipulate application bandwidth\n- Limits network throughput to extremely low levels (e.g., 8 bits per second)\n- Causes security agents to repeatedly time out when attempting to communicate with their cloud backend\n\nAs a result, telemetry ingestion, alerting, and remote response capabilities may be significantly degraded, while the agent itself continues to run and appear operational.\n\nThis technique is inspired by research from Zero Salarium and the associated EDRChoker tool (https://www.zerosalarium.com/2026/06/edrchoker-choking-telemetry-stream-block-edr.html), which demonstrates how adversaries can exploit the reliance of modern EDR solutions on persistent, low-latency cloud connectivity to create a temporary loss of visibility without triggering traditional tampering detections.","inputs":{"process_name":{"type":"string","default":"MsSense.exe","description":"Name of the process to throttle"},"throttle_rate":{"type":"integer","default":"8","description":"Bandwidth limit in bits per second"},"net_qos_policy_name":{"type":"string","default":"CyberSecurityAgentThrottlingTest","description":"Name of the Network QoS Policy to create then delete"}},"dependencies":[{"description":"Ensure PowerShell QoS cmdlets are available"}],"source_definition_sha256":"ba86caa2b6e91f787b090d4f6748a745683a9438d6bbe72b9de95d7f43cc1d2d"},{"id":"811b3e76-c41b-430c-ac0d-e2380bfaa164","name":"Unload Sysmon Filter Driver","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":3,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Unloads the Sysinternals Sysmon filter driver without stopping the Sysmon service. To verify successful execution,\nrun the prereq_command's and it should fail with an error of \"sysmon filter must be loaded\".\n","inputs":{"sysmon_driver":{"description":"The name of the Sysmon filter driver (this can change from the default)","type":"string","default":"SysmonDrv"}},"dependencies":[{"description":"Sysmon must be downloaded\n"},{"description":"sysmon must be Installed\n"},{"description":"sysmon filter must be loaded\n"}],"source_definition_sha256":"9c71ff328c6826bb521ba35c6cba7035359d2aab6089837fee700165ccee464c"},{"id":"81ce22fd-9612-4154-918e-8a1f285d214d","name":"Disable Defender Using NirSoft AdvancedRun","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Information on NirSoft AdvancedRun and its creators found here: http://www.nirsoft.net/utils/advanced_run.html\nThis Atomic will run AdvancedRun.exe with similar behavior identified during the WhisperGate campaign.\nSee https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3\nUpon successful execution, AdvancedRun.exe will attempt to run and stop Defender, and optionally attempt to delete the Defender folder on disk. \n","inputs":{"AdvancedRun_Location":{"description":"Path of Advanced Run executable","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\AdvancedRun.exe"},"delete_defender_folder":{"description":"Set to 1 to also delete the Windows Defender folder","type":"integer","default":0}},"dependencies":[{"description":"Advancedrun.exe must exist at #{AdvancedRun_Location}\n"}],"source_definition_sha256":"83f43be77765927cc90a7834540b1fd2bb4bd7778e7d71a6809ee6553b3d3df1"},{"id":"828a1278-81cc-4802-96ab-188bf29ca77d","name":"Stop Crowdstrike Falcon on Linux","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Stop and disable Crowdstrike Falcon on Linux\n","inputs":{},"dependencies":[],"source_definition_sha256":"86a0539adbdb2beb1e8bd9d1a15d59451f15836ffa6ab4b976c5f6aa25878ce6"},{"id":"871438ac-7d6e-432a-b27d-3e7db69faf58","name":"Disable Windows Defender with DISM","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"The following Atomic will attempt to disable Windows-Defender using the built in DISM.exe, Deployment Image Servicing and Management tool. \nDISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images.\nA successful execution will not standard-out any details. Remove the quiet switch if verbosity is needed.\nThis method will remove Defender and it's package.\n","inputs":{},"dependencies":[],"source_definition_sha256":"757ca747c3b39f33ea5dedbe07fccffd19905284948870dbb54340bb13af02c9"},{"id":"8a4c33be-a0d3-434a-bee6-315405edbd5b","name":"Disable .NET Event Tracing for Windows Via Registry (cmd)","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Disables ETW for the .NET Framework using the reg.exe utility to update the Windows registry","inputs":{},"dependencies":[],"source_definition_sha256":"b21f178b4cfadaf0981c5cb9b457d866866fe5e8699ac22ebafc17f685c71a05"},{"id":"8f907648-1ebf-4276-b0f0-e2678ca474f0","name":"Disable EventLog-Application ETW Provider Via Registry - PowerShell","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"This atomic simulates an activity where an attacker disables a specific ETW provider from the EventLog-Application ETW Auto Logger session using the powershell.exe \"New-ItemProperty\" cmdlet to update the Windows registry value \"Enabled\". This would effectivly remove that provider from the session and cause to not emit any logs of that type. The changes would only take effect after a restart.","inputs":{"ETWProviderGUID":{"type":"string","default":"{B6D775EF-1436-4FE6-BAD3-9E436319E218}","description":"Microsoft-Windows-SenseIR ETW Provider GUID"}},"dependencies":[],"source_definition_sha256":"e1de450c2983fa2d1eaaef0f2e02875354b9ec18c06b2d3d0f24cba7b04ee7f3"},{"id":"8fba7766-2d11-4b4a-979a-1e3d9cc9a88c","name":"Disable Carbon Black Response","platforms":["macos"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Disables Carbon Black Response\n","inputs":{},"dependencies":[],"source_definition_sha256":"3d06acec714021e700e93613064c48548cdd300a7907da233db8f78eb56df704"},{"id":"94f6a1c9-aae7-46a4-9083-2bb1f5768ec4","name":"Suspend History","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"suspend Shell History seen in Awfulshred wiper- https://unix.stackexchange.com/questions/10922/temporarily-suspend-bash-history-on-a-given-shell\n","inputs":{},"dependencies":[],"source_definition_sha256":"baceee38abfb8485c0a8707ceaac5e93de58ee9d7dd93e76b80112b0e31db2eb"},{"id":"9719d0e1-4fe0-4b2e-9a72-7ad3ee8ddc70","name":"LockBit Black - Use Registry Editor to turn on automatic logon -cmd","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"LockBit Black - Use Registry Editor to turn on automatic logon\n","inputs":{},"dependencies":[],"source_definition_sha256":"61967e571a766990c31ed06ef704ee8c3ec8e321da329d002fbc7c8cf4165104"},{"id":"a1230893-56ac-4c81-b644-2108e982f8f5","name":"Disable Arbitrary Security Windows Service","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"With administrative rights, an adversary can disable Windows Services related to security products. This test requires McAfeeDLPAgentService to be installed.\nChange the service_name input argument for your AV solution. Upon exeuction, infomration will be displayed stating the status of the service.\nTo verify that the service has stopped, run \"sc query McAfeeDLPAgentService\"\n","inputs":{"service_name":{"description":"The name of the service to stop","type":"string","default":"McAfeeDLPAgentService"}},"dependencies":[],"source_definition_sha256":"6631483d9109132b134e174930612a0048b0dd70f77873616779f3c7f2680b16"},{"id":"a123ce6a-3916-45d6-ba9c-7d4081315c27","name":"Tamper with Windows Defender Evade Scanning -Process","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Malware can exclude specific processes from being scanned and evading detection.\nUpon successful execution, the process(es) should be on the list of excluded processes. \nTo check the exclusion list using poweshell  (Get-MpPreference).ExclusionProcess.\"\n","inputs":{"excluded_process":{"description":"A list of processes to exclude from scanning","type":"string","default":"outlook.exe"}},"dependencies":[],"source_definition_sha256":"550e0c5c6143f6d57ad5021473e9fb92d6344d6b63b6c982e91051cd1c58cc35"},{"id":"a316fb2e-5344-470d-91c1-23e15c374edc","name":"Uninstall Sysmon","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":2,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Uninstall Sysinternals Sysmon for Defense Evasion\n","inputs":{"sysmon_exe":{"description":"The location of the Sysmon executable from Sysinternals (ignored if sysmon.exe is found in your PATH)","type":"path","default":"PathToAtomicsFolder\\T1685\\bin\\sysmon.exe"}},"dependencies":[{"description":"Sysmon executable must be available\n"},{"description":"Sysmon must be installed\n"}],"source_definition_sha256":"c8528464c1cd28fc0a860b61047919df064256310e2124703e66909fac33b5a0"},{"id":"a72cfef8-d252-48b3-b292-635d332625c3","name":"Tamper with Windows Defender Registry - Powershell","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Disable Windows Defender by tampering with windows defender registry through powershell\n","inputs":{},"dependencies":[],"source_definition_sha256":"ad75d38848a0e4e446e034f5dcf99d485a5129d4de129a177078e6c581e7be1e"},{"id":"aa875ed4-8935-47e2-b2c5-6ec00ab220d2","name":"Tamper with Windows Defender Command Prompt","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Attempting to disable scheduled scanning and other parts of windows defender atp. These commands must be run as System, so they still fail as administrator.\nHowever, adversaries do attempt to perform this action so monitoring for these command lines can help alert to other bad things going on. Upon execution, \"Access Denied\"\nwill be displayed twice and the WinDefend service status will be displayed.\n","inputs":{},"dependencies":[],"source_definition_sha256":"6aefcc315c5695455b92f8009465d5b182fa325a267ee916f5200b0be30cbaed"},{"id":"ac333fe1-ce2b-400b-a117-538634427439","name":"Disable ASLR Via sysctl parameters - Linux","platforms":["linux"],"method":"automated","executor":"bash","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Detects Execution of the `sysctl` command to set `kernel.randomize_va_space=0` which disables Address Space Layout Randomization (ASLR) in Linux.","inputs":{},"dependencies":[],"source_definition_sha256":"e95d5728b0953952c685c282cafa35b16b3b0829ae46fffd34cab257a2c5a8a0"},{"id":"ae753dda-0f15-4af6-a168-b9ba16143143","name":"Stop and Remove Arbitrary Security Windows Service","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Beginning with Powershell 6.0, the Stop-Service cmdlet sends a stop message to the Windows Service Controller for each of the specified services. The Remove-Service cmdlet removes a Windows service in the registry and in the service database.\n","inputs":{"service_name":{"description":"The name of the service to remove","type":"string","default":"McAfeeDLPAgentService"}},"dependencies":[],"source_definition_sha256":"27b056ff766b474998d3b540584bc572c313f3b3890050430d8eb18529d54a78"},{"id":"ae8943f7-0f8d-44de-962d-fbc2e2f03eb8","name":"Disable Cb Response","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Disable the Cb Response service\n","inputs":{},"dependencies":[],"source_definition_sha256":"883613be792abf45eaafc85bd50369d4fc3eb319ecdaada0b0839e5625724a14"},{"id":"b32b1ccf-f7c1-49bc-9ddd-7d7466a7b297","name":"Uninstall Crowdstrike Falcon on Windows","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Uninstall Crowdstrike Falcon. If the WindowsSensor.exe path is not provided as an argument we need to search for it. Since the executable is located in a folder named with a random guid we need to identify it before invoking the uninstaller.\n","inputs":{"falcond_path":{"description":"The Crowdstrike Windows Sensor path. The Guid always changes.","type":"path","default":"C:\\ProgramData\\Package Cache\\{7489ba93-b668-447f-8401-7e57a6fe538d}\\WindowsSensor.exe"}},"dependencies":[],"source_definition_sha256":"ed9a30b1ea5e3f0a6da1ab2772d82c8eacc542689bb4232a7c839d1ef4ac0c98"},{"id":"b3e7510c-2d4c-4249-a33f-591a2bc83eef","name":"Stop and unload Crowdstrike Falcon on macOS","platforms":["macos"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Stop and unload Crowdstrike Falcon daemons falcond and userdaemon on macOS\n","inputs":{"falcond_plist":{"description":"The path of the Crowdstrike Falcon plist file","type":"path","default":"/Library/LaunchDaemons/com.crowdstrike.falcond.plist"},"userdaemon_plist":{"description":"The path of the Crowdstrike Userdaemon plist file","type":"path","default":"/Library/LaunchDaemons/com.crowdstrike.userdaemon.plist"}},"dependencies":[],"source_definition_sha256":"6a5550e9993dff66e2c0ba5dd78eba9bdb2bcf8828ddfa3a3badef6d52f2eeca"},{"id":"b42c1f8c-399b-47ae-8fd8-763181395fee","name":"Disable .NET Event Tracing for Windows Via Environment Variable HKCU Registry - PowerShell","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Disables ETW for the .NET Framework by setting the COMPlus_ETWEnabled environment variable to 0 in the HKCU registry using PowerShell. In order for changes to take effect a logout might be required.","inputs":{},"dependencies":[],"source_definition_sha256":"f9eb085e0f2fbef60ff272a538b09e8f326c33aa1714b4d03a63ebc0dd738e19"},{"id":"c3a377f9-1203-4454-aa35-9d391d34768f","name":"Disable journal logging via systemctl utility","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"The atomic test disables the journal logging using built-in systemctl utility\n","inputs":{},"dependencies":[],"source_definition_sha256":"20a40ce3826b131430e43cb6d2a862d902f3e37eaf249102cf9e10552f21a78d"},{"id":"c531aa6e-9c97-4b29-afee-9b7be6fc8a64","name":"Tamper with Windows Defender ATP using Aliases - PowerShell","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Attempting to disable scheduled scanning and other parts of Windows Defender ATP using set-MpPreference aliases. Upon execution Virus and Threat Protection will show as disabled\nin Windows settings.\n","inputs":{},"dependencies":[],"source_definition_sha256":"b7aa501a93c3905d7cbd2b34d275bd519dcae5dfeb8202d044085b38cac9eeeb"},{"id":"cbb2573a-a6ad-4c87-aef8-6e175598559b","name":"Freeze PPL-protected process with EDR-Freeze","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"This test utilizes the tool EDR-Freeze, which leverages the native Microsoft binary WerFaultSecure.exe to suspend processes protected by the Protected Process Light mechanism. PPL is a Windows security feature designed to safeguard critical system processes — such as those related to antivirus, credential protection, and system integrity — from tampering or inspection. These processes operate in a restricted environment that prevents access even from administrators or debugging tools, unless the accessing tool is signed and trusted by Microsoft. By using WerFaultSecure.exe, which is inherently trusted by the operating system, EDR-Freeze is able to bypass these restrictions and temporarily freeze PPL-protected processes for analysis or testing purposes.","inputs":{"processName":{"type":"string","default":"SecurityHealthService","description":"PPL-protected process name to target"}},"dependencies":[],"source_definition_sha256":"a32227f7a68d24d9a7bc21a308ebf61c29e06665d6f91660dca3bba07d7ac727"},{"id":"cedaf7e7-28ee-42ab-ba13-456abd35d1bd","name":"Auditing Configuration Changes on FreeBSD Host","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Emulates modification of auditd configuration files\n","inputs":{"auditd_config_file_name":{"description":"The name of the auditd configuration file to be changed","type":"string","default":"audit_event"}},"dependencies":[],"source_definition_sha256":"81f8278d2ac01a2815d71d2f2ac68fe37a447f1062eed07dcd52b68cd364319f"},{"id":"d6d22332-d07d-498f-aea0-6139ecb7850e","name":"LockBit Black - Disable Privacy Settings Experience Using Registry -cmd","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"LockBit Black - Disable Privacy Settings Experience Using Registry\n","inputs":{},"dependencies":[],"source_definition_sha256":"bb8355ea4e1f139a2f3667127c3eab6af01ec5a78bd5de370e69d9d824aedf35"},{"id":"d8c57eaa-497a-4a08-961e-bd5efd7c9374","name":"LockBit Black - Disable Privacy Settings Experience Using Registry -Powershell","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"LockBit Black - Disable Privacy Settings Experience Using Registry\n","inputs":{},"dependencies":[],"source_definition_sha256":"b051bb1d66a343692de456694ff05eb4bc22b3883c98ec8d8539e3c9e0f2d814"},{"id":"da86f239-9bd3-4e85-92ed-4a94ef111a1c","name":"Disable EventLog-Application Auto Logger Session Via Registry - PowerShell","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"This atomic simulates an activity where an attacker disables the EventLog-Application ETW Auto Logger session using the powershell.exe \"New-ItemProperty\" cmdlet to update the Windows registry value \"Start\". This would effectivly disable the Event log application channel. The changes would only take effect after a restart.","inputs":{},"dependencies":[],"source_definition_sha256":"932bce29281fdb5189176a3c81a6eec8650a6f7db93919ac8b5d48172b5dddd1"},{"id":"db9de996-441e-4ae0-947b-61b6871e2fdf","name":"Disable syslog (freebsd)","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Disables syslog collection\n","inputs":{},"dependencies":[],"source_definition_sha256":"ea687d8e4398a6a683c646823c7e235b7ad83d87bd714831ca7d8b1f265b58ce"},{"id":"e74e4c63-6fde-4ad2-9ee8-21c3a1733114","name":"Disable Memory Swap","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"disable swapping of device paging that impaire the compromised host to swap data if the RAM is full. Awfulshred wiper used this technique as an additional \npayload to the compromised host and to make sure that there will be no recoverable data due to swap feature of FreeBSD/linux.\n","inputs":{},"dependencies":[],"source_definition_sha256":"f81f8c75c8861d8316fde3776d97c70dea3826264c260df9b22584fd74086f72"},{"id":"eea0a6c2-84e9-4e8c-a242-ac585d28d0d1","name":"Delete Microsoft Defender ASR Rules - InTune","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"This test simulates the deletion of the ASR rules loaded by Microsoft Defender using the registry. Depending on the deployment, rules can be pushed either using GPO or InTune, This test simulates an InTune-based rules deployment.","inputs":{},"dependencies":[],"source_definition_sha256":"64cbcc639ab91c2046da562e0066388c386c5b230fd7717c94632cd8ceb69c8f"},{"id":"f542ffd3-37b4-4528-837f-682874faa012","name":"Disable Windows Defender with PwSh Disable-WindowsOptionalFeature","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"The following Atomic will attempt to disable Windows-Defender using the built in PowerShell cmdlet Disable-WindowsOptionalFeature, Deployment Image Servicing and Management tool. \nSimilar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images.\nA successful execution will not standard-out any details. Remove the quiet switch if verbosity is needed.\nThis method will remove Defender and it's packages.\nReference: https://docs.microsoft.com/en-us/powershell/module/dism/disable-windowsoptionalfeature?view=windowsserver2022-ps\n","inputs":{},"dependencies":[],"source_definition_sha256":"2915070b13e1f7b34eb69ce8f71c2312e15fcacbe1cd21e4c1da6ec4228f579a"},{"id":"f6df0b8e-2c83-44c7-ba5e-0fa4386bec41","name":"LockBit Black - Disable the ETW Provider of Windows Defender -cmd","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"An adversary can disable the ETW Provider of Windows Defender,\nso nothing would be logged to Microsoft-Windows-Windows-Defender/Operational anymore.\nhttps://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a\n","inputs":{},"dependencies":[],"source_definition_sha256":"b4a7a2fe8946da11b5f16113c8a68b677694c615f5e3f65bbaf25e50fcdd7f82"},{"id":"f790927b-ea85-4a16-b7b2-7eb44176a510","name":"Clear Pagging Cache","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"clear pagging cache via system request. This is a temporary change in the system to clear paging cache. This technique seen in Awfulshred wiper as part\nof its malicious payload on the compromised host. added reference link for this technique: https://www.tecmint.com/clear-ram-memory-cache-buffer-and-swap-space-on-linux/\n","inputs":{},"dependencies":[],"source_definition_sha256":"60ac7b435549e938313ebb37f728b516cbd7d998475a0eb7b8e77c2dd32745f8"},{"id":"fc225f36-9279-4c39-b3f9-5141ab74f8d8","name":"Disable SELinux","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Disables SELinux enforcement\n","inputs":{},"dependencies":[{"description":"SELinux must be installed\n"}],"source_definition_sha256":"b0ceab0c0b8b0f17b62dd0a3dcee676dd153ede7a452d73f4dae9b604e65fc6f"},{"id":"fdac1f79-b833-4bab-b4a1-11b1ed676a4b","name":"Disable .NET Event Tracing for Windows Via Environment Variable HKCU Registry - Cmd","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Disables ETW for the .NET Framework by setting the COMPlus_ETWEnabled environment variable to 0 in the HKCU registry using the reg.exe utility. In order for changes to take effect a logout might be required.","inputs":{},"dependencies":[],"source_definition_sha256":"2da528f32c6d113de6273d3892f4ee2dcbe49fd507e61dae404f593309391eb0"},{"id":"ff543dd9-4537-458c-b297-c85ae1939e34","name":"AMSI Bypass - Patching AmsiScanBuffer","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1685/T1685.yaml","description":"Patches AmsiScanBuffer in memory using P/Invoke to resolve the function address via\nGetModuleHandle/GetProcAddress, then overwrites the prologue with instructions that\nreturn AMSI_RESULT_CLEAN immediately (mov al, 1; ret).\n\nReference: https://i.blackhat.com/briefings/asia/2018/asia-18-Tal-Liberman-Documenting-the-Undocumented-The-Rise-and-Fall-of-AMSI.pdf\n","inputs":{},"dependencies":[],"source_definition_sha256":"dba5a913218eda1f0b087b659995d24788a021856bc38f5561fd9f2d26581d6e"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1685":"/ttp-simulation/techniques/enterprise/T1685/","T1106":"/ttp-simulation/techniques/enterprise/T1106/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1685","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0069","collector":"illustrative-lab-collector","observation":{"service":"lab-audit-service","resource_id":"lab-service-1","attribute":"retention_days","before":7,"after":30}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0018","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-host-1","status":"degraded","heartbeat_age_seconds":90,"collector_healthy":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0033","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","process_id":4200,"action":"terminate"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0060","collector":"illustrative-lab-collector","observation":{"service":"LabService","action":"install","executable":"C:\\Lab\\service.exe","actor":"lab-admin"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0041","collector":"illustrative-lab-collector","observation":{"service":"LabService","executable":"C:\\Lab\\service.exe","start_mode":"manual","state":"stopped"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0065","collector":"illustrative-lab-collector","observation":{"service":"LabService","attribute":"start_mode","before":"manual","after":"automatic"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}}]}}