Procedure examples

Aquatic Panda has attempted to stop endpoint detection and response (EDR) tools on compromised systems.

Saint Bear will modify registry entries and scheduled task objects associated with Windows Defender to disable its functionality.

Turla has used a AMSI bypass, which patches the in-memory amsi.dll, in PowerShell scripts to bypass Windows antimalware products.

TA505 has used malware to disable Windows Defender.

MirrorFace has disabled Windows Defender in compromised environments.

Medusa Group has terminated antivirus services utilizing the gaze.exe executable and utilizing `psexec.exe`. Medusa Group has also leveraged I/O control codes (IOCTLs) for terminating and deleting processes of identified security tools.

BRONZE BUTLER has incorporated code into several tools that attempts to terminate anti-virus processes.

Agrius used several mechanisms to try to disable security tools. Agrius attempted to modify EDR-related services to disable auto-start on system reboot. Agrius used a publicly available driver, GMER64.sys typically used for anti-rootkit functionality, to selectively stop and remove security software processes.

APT5 has used the CLEANPULSE utility to insert command line strings into a targeted process to prevent certain log events from occurring.

Lazarus Group malware TangoDelta attempts to terminate various processes associated with McAfee. Additionally, Lazarus Group malware SHARPKNOT disables the Microsoft Windows System Event Notification and Alerter services..

INC Ransom can use SystemSettingsAdminFlows.exe, a native Windows utility, to disable Windows Defender.

Wizard Spider has shut down or uninstalled security applications on victim systems that might prevent ransomware from executing.

Velvet Ant attempted to disable local security tools and endpoint detection and response (EDR) software during operations.

Play has used tools including GMER, IOBit, and PowerTool to disable antivirus software.

Magic Hound has disabled antivirus services on targeted systems in order to upload malicious payloads.

HDoor kills anti-virus found on the victim.

TrickBot can disable Windows Defender.

EKANS stops processes related to security and management software.

JumbledPath can impair logging on all devices used along its connection path to compromised hosts.

Stuxnet reduces the integrity level of objects to allow write actions.

RobbinHood will search for Windows services that are associated with antivirus software on the system and kill the process.

StrongPity can add directories used by the malware to the Windows Defender exclusions list to prevent detection.

Brave Prince terminates antimalware processes.

Medusa Ransomware has terminated antivirus services utilizing the gaze.exe executable. Medusa Ransomware has also terminated antivirus services utilizing PowerShell scripts.

macOS.OSAMiner has searched for the Activity Monitor process in the System Events process list and kills the process if running. macOS.OSAMiner also searches the operating system's `install.log` for apps matching its hardcoded list, killing all matching process names.

SslMM identifies and kills anti-malware processes.

BOLDMOVE can disable the Fortinet daemons `moglogd` and `syslogd` to evade detection and logging.

Woody RAT has suppressed all error reporting by calling `SetErrorMode` with 0x8007 as a parameter.

ShrinkLocker disables protectors used to secure the BitLocker encryption key on victim systems.

Hildegard has modified DNS resolvers to evade DNS monitoring tools.

WhisperGate can download and execute AdvancedRun.exe to disable the Windows Defender Theat Protection service and set an exclusion path for the C:\ drive.

Skidmap has the ability to set SELinux to permissive mode.

Raspberry Robin can add an exception to Microsoft Defender that excludes the entire main drive from anti-malware scanning to evade detection.

Diavol can attempt to stop security software.

DarkComet can disable Security Center functions like anti-virus.

HUI Loader has the ability to disable Windows Event Tracing for Windows (ETW) and Antimalware Scan Interface (AMSI) functions.

Ragnar Locker has attempted to terminate/stop processes and services associated with endpoint security products.

Avaddon looks for and attempts to stop anti-malware solutions.

Conficker terminates various services related to system security and Windows.

LockerGoga installation has been immediately preceded by a "task kill" command in order to disable anti-virus.

RunningRAT kills antimalware running process.

Babuk can stop anti-virus services on a compromised host.

MultiLayer Wiper removes the Volume Shadow Copy (VSS) service from infected devices along with all present shadow copies.

Lumma Stealer has attempted to bypass Windows Antimalware Scan Interface (AMSI) by removing the string “AmsiScanBuffer” from the “clr.dll” module in memory to prevent it from being called.

PureCrypter has executed `Set-MpPreference -ExclusionPath` to exclude files or folders from Windows Defender scans.

DarkGate will terminate processes associated with several security software products if identified during execution.

NanHaiShu can change Internet Explorer settings to reduce warnings about malware activity.

LockBit 3.0 can disable security tools to evade detection including Windows Defender.

ThiefQuest uses the function kill_unwanted to obtain a list of running processes and kills each process matching a list of security related processes.

Netwalker can detect and terminate active security software-related processes on infected systems.