Procedure examples

TrickBot can disable Windows Defender.

EKANS stops processes related to security and management software.

JumbledPath can impair logging on all devices used along its connection path to compromised hosts.

Stuxnet reduces the integrity level of objects to allow write actions.

RobbinHood will search for Windows services that are associated with antivirus software on the system and kill the process.

StrongPity can add directories used by the malware to the Windows Defender exclusions list to prevent detection.

Brave Prince terminates antimalware processes.

Medusa Ransomware has terminated antivirus services utilizing the gaze.exe executable. Medusa Ransomware has also terminated antivirus services utilizing PowerShell scripts.

macOS.OSAMiner has searched for the Activity Monitor process in the System Events process list and kills the process if running. macOS.OSAMiner also searches the operating system's `install.log` for apps matching its hardcoded list, killing all matching process names.

SslMM identifies and kills anti-malware processes.

BOLDMOVE can disable the Fortinet daemons `moglogd` and `syslogd` to evade detection and logging.

Woody RAT has suppressed all error reporting by calling `SetErrorMode` with 0x8007 as a parameter.

ShrinkLocker disables protectors used to secure the BitLocker encryption key on victim systems.

Hildegard has modified DNS resolvers to evade DNS monitoring tools.

WhisperGate can download and execute AdvancedRun.exe to disable the Windows Defender Theat Protection service and set an exclusion path for the C:\ drive.

Skidmap has the ability to set SELinux to permissive mode.

Raspberry Robin can add an exception to Microsoft Defender that excludes the entire main drive from anti-malware scanning to evade detection.

Diavol can attempt to stop security software.

DarkComet can disable Security Center functions like anti-virus.

HUI Loader has the ability to disable Windows Event Tracing for Windows (ETW) and Antimalware Scan Interface (AMSI) functions.

Ragnar Locker has attempted to terminate/stop processes and services associated with endpoint security products.

Avaddon looks for and attempts to stop anti-malware solutions.

Conficker terminates various services related to system security and Windows.

LockerGoga installation has been immediately preceded by a "task kill" command in order to disable anti-virus.

RunningRAT kills antimalware running process.

Babuk can stop anti-virus services on a compromised host.

MultiLayer Wiper removes the Volume Shadow Copy (VSS) service from infected devices along with all present shadow copies.

Lumma Stealer has attempted to bypass Windows Antimalware Scan Interface (AMSI) by removing the string “AmsiScanBuffer” from the “clr.dll” module in memory to prevent it from being called.

PureCrypter has executed `Set-MpPreference -ExclusionPath` to exclude files or folders from Windows Defender scans.

DarkGate will terminate processes associated with several security software products if identified during execution.

NanHaiShu can change Internet Explorer settings to reduce warnings about malware activity.

LockBit 3.0 can disable security tools to evade detection including Windows Defender.

ThiefQuest uses the function kill_unwanted to obtain a list of running processes and kills each process matching a list of security related processes.

Netwalker can detect and terminate active security software-related processes on infected systems.

Bundlore can change browser security settings to enable extensions to be installed. Bundlore uses the pkill cfprefsd command to prevent users from inspecting processes.

Metamorfo has a function to kill processes associated with defenses and can prevent certain processes from launching.

RedLine Stealer can disable security software and update services.

MegaCortex was used to kill endpoint security processes.

BlackByte Ransomware adds .JS and .EXE extensions to the Microsoft Defender exclusion list. BlackByte Ransomware terminates and removes the Raccine anti-ransomware utility.

Grandoreiro can hook APIs, kill processes, break file system paths, and change ACLs to prevent security tools from running.

Bazar has manually loaded ntdll from disk in order to identity and remove API hooks set by security products.

XLoader loads a copy of NTDLL to evade hooks from security monitoring tools on this library. XLoader can add the path of its executable to the Microsoft Defender exclusion list.

Ryuk has stopped services related to anti-virus.

HermeticWiper has the ability to set the `HKLM:\SYSTEM\\CurrentControlSet\\Control\\CrashControl\CrashDumpEnabled` Registry key to `0` in order to disable crash dumps.

Pysa has the capability to stop antivirus services and disable Windows Defender.

LockBit 2.0 can disable firewall rules and anti-malware and monitoring software including Windows Defender.

Cobalt Strike has the ability to use Smart Applet attacks to disable the Java SecurityManager sandbox.

SUNBURST attempted to disable software security services following checks against a FNV-1a + XOR hashed hardcoded blocklist.

Unknown Logger has functionality to disable security tools, including Kaspersky, BitDefender, and MalwareBytes.

REvil can connect to and disable the Symantec server on the victim's network.