Detecting Modified or Spoofed Security Tool UI (MITRE ATT&CK T1685.003)

Modify or Spoof Tool UI (T1685.003) is a sub-technique of Disable or Modify Tools. Adversaries manipulate or imitate the interface of a security tool so it appears healthy when it is not. MITRE lists the Defense Impairment tactic and Linux, macOS and Windows as platforms.

How attackers use it

Security tools show health through status icons, dashboards and messages. If an adversary has disabled the tool and then shows the usual "protected" display, defenders and users may trust it, which delays investigation.

MITRE says this is often paired with disabling or modifying tools. First the adversary reduces the tool's function, such as an EDR or logging agent. Then they replace or imitate the interface so the loss is hidden, showing active protection, successful updates or no threats.

MITRE's example is a fake Windows Security interface or tray icon that shows a "protected" state after Windows Defender or related services have been disabled. Other documented uses include fake "system update complete" dialogs after a payload is installed, fake error messages that explain away failures, and a compromised appliance that intercepted an upgrade command and displayed a fake progress bar so the device stayed in the adversary's hands.

How to detect it

MITRE's detection idea is to compare what a tool reports with the state of the underlying system:

• Windows. The Defender tray icon or interface shows healthy while the matching services, WinDefend and MsMpEng, are stopped or disabled. Correlate process creation events with missing or terminated security processes and spoofed health events.
• Linux. Syslog says an AV or IDS daemon stopped while messages claim it is running. Look for user processes that imitate AV or IDS command line output, or that change log forwarding configuration.
• macOS. Fake security and privacy interfaces showing a healthy state after XProtect, Gatekeeper or an AV process was disabled. Correlate the creation of a user-space UI process with terminated or missing security daemons.

The principle is to trust the telemetry from the service layer and a central console, not the local display.

How to reduce the risk

MITRE lists one mitigation, Execution Prevention: use application control to limit the installation and use of payloads that could spoof security alerts.

Add to that:

• Check tool health from the central console, not from the endpoint screen.
• Alert when a protection service stops, whatever the tray icon says.
• Tell users that an unexpected security popup is worth reporting, and give them a way to do so.

Quick check

Sources

• MITRE ATT&CK, Modify or Spoof Tool UI (T1685.003): https://attack.mitre.org/techniques/T1685/003