Detecting and Mitigating Disable or Modify Tools (MITRE ATT&CK T1685)

Disable or Modify Tools (T1685) is the technique of tampering with security tools so that defenders see less. MITRE lists it under the Defense Impairment tactic, with platforms including Containers, ESXi, IaaS, Linux, macOS, Network Devices and Windows.

It is the parent of seven sub-techniques, among them Disable or Modify Windows Event Log (T1685.001), Disable or Modify Cloud Log (T1685.002), Modify or Spoof Tool UI (T1685.003), Disable or Modify Linux Audit System Log (T1685.004), Clear Windows Event Logs (T1685.005) and Clear Linux or Mac System Logs (T1685.006).

How attackers use it

MITRE describes disabling, degrading or tampering with tools such as endpoint detection and response (EDR), intrusion detection systems (IDS), antivirus, logging agents and sensors. That can mean stopping services, killing processes, changing or deleting configuration files and Registry keys, or stopping tools from updating.

The technique also covers the telemetry those tools depend on. MITRE lists disabling or redirecting sensors such as Event Tracing for Windows (ETW), changing event log settings such as redirecting Security logs, and interfering with logging pipelines and forwarding, including SIEM ingestion.

More advanced versions use legitimate drivers or debugging mechanisms to make tools stop working, bypass anti-tampering protections, or target specific defenses such as Sysmon and cloud monitoring agents. Adversaries may also disrupt wider defensive operations, including update mechanisms, syslog, and event aggregation.

The technique page's examples include malware that kills running analysis processes and antivirus software, an actor that edited EDR services to stop them starting on reboot, and a publicly available anti-rootkit driver used to selectively stop and remove security software.

The key point for defenders: this often happens early in an intrusion, before the noisy steps. If you lose visibility first, you may see little of what follows.

How to detect it

MITRE's detection strategy covers several platforms, and its core idea is to watch for both the action and the silence that follows it.

• Endpoints, all platforms. Process or service termination, Registry changes such as altering Sysmon keys, tampering with exclusion lists, and the abnormal absence of expected telemetry.
• Linux. kill, systemctl and service commands aimed at EDR, auditd, Falco, osquery, rsyslog, journald or agent processes, edits that disable startup, module unload attempts, and logs that suddenly stop after a privileged shell session.
• macOS. Unloading launch agents or daemons, changing configuration profiles, disabling Gatekeeper, XProtect or logging settings, or removing agents, followed by loss of telemetry.
• Cloud. Control plane API actions that disable native monitoring or sensor agents (the page names CloudTrail, GuardDuty, Security Hub and Defender), role abuse that comes before the disablement, and agent uninstall events on instances.
• Containers. Removing sidecar sensors, changing seccomp or AppArmor profiles, mounting host proc or sys paths to interfere with host logging, or killing in-container monitoring agents.
• Network devices. Disabling AAA, syslog, SNMP traps, ACL logging or security features, with a privileged login followed by a configuration commit that reduces visibility.
• ESXi. esxcli commands that disable syslog, the firewall or lockdown mode, or that stop hostd or vpxa, correlated with less forwarding activity.

The most reliable single control is a heartbeat. Every host and device that should report should be on a list, and a missing report should raise an alert.

How to reduce the risk

MITRE lists five mitigations.

1. User Account Management. Set permissions so adversaries cannot disable or interfere with security services.
2. Audit. Periodically verify that tools work. For example, confirm that every expected host is checking in to the central console, and check EDRs for exclusion paths that nobody added on purpose. In Microsoft Defender for Endpoint, exclusions can be reviewed with Get-MpPreference.
3. Restrict File and Directory Permissions. Protect the processes and files of security services.
4. Disable or Remove Feature or Program. Remove old versions of tools that the environment does not need.
5. Software Configuration. Consider relaunching forwarding mechanisms automatically at recurring intervals, such as on a timer or at logon, and apply change management to firewall rules and related settings.

Check your own environment

On Windows with Microsoft Defender, review exclusions with this read-only PowerShell command:

Get-MpPreference | Select-Object ExclusionPath, ExclusionExtension, ExclusionProcess

Then work through this checklist:

• Compare your asset list with the list of hosts reporting to your EDR and log platform this week. Investigate every gap.
• Review who holds rights to stop security services or edit their configuration.
• Check that logs leave each system quickly, so that stopping the agent does not erase the record.
• Confirm you receive an alert when an agent stops, a sensor is removed or a forwarding rule changes.
• Remove retired versions of agents.
• Set a recurring review of exclusion lists, with an owner.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• MITRE ATT&CK, Disable or Modify Tools (T1685): https://attack.mitre.org/techniques/T1685