Procedure examples

Bundlore can change browser security settings to enable extensions to be installed. Bundlore uses the pkill cfprefsd command to prevent users from inspecting processes.

Metamorfo has a function to kill processes associated with defenses and can prevent certain processes from launching.

RedLine Stealer can disable security software and update services.

MegaCortex was used to kill endpoint security processes.

BlackByte Ransomware adds .JS and .EXE extensions to the Microsoft Defender exclusion list. BlackByte Ransomware terminates and removes the Raccine anti-ransomware utility.

Grandoreiro can hook APIs, kill processes, break file system paths, and change ACLs to prevent security tools from running.

Bazar has manually loaded ntdll from disk in order to identity and remove API hooks set by security products.

XLoader loads a copy of NTDLL to evade hooks from security monitoring tools on this library. XLoader can add the path of its executable to the Microsoft Defender exclusion list.

Ryuk has stopped services related to anti-virus.

HermeticWiper has the ability to set the `HKLM:\SYSTEM\\CurrentControlSet\\Control\\CrashControl\CrashDumpEnabled` Registry key to `0` in order to disable crash dumps.

Pysa has the capability to stop antivirus services and disable Windows Defender.

LockBit 2.0 can disable firewall rules and anti-malware and monitoring software including Windows Defender.

Cobalt Strike has the ability to use Smart Applet attacks to disable the Java SecurityManager sandbox.

SUNBURST attempted to disable software security services following checks against a FNV-1a + XOR hashed hardcoded blocklist.

Unknown Logger has functionality to disable security tools, including Kaspersky, BitDefender, and MalwareBytes.

REvil can connect to and disable the Symantec server on the victim's network.

NanoCore can modify the victim's anti-virus.

Gold Dragon terminates anti-malware processes if they’re found running on the system.

Carberp has attempted to disable security software by creating a suspended process for the security software and injecting code to delete antivirus core files when the process is resumed.

TinyZBot can disable Avira anti-virus.

Proton kills security tools like Wireshark that are running.

Mango contains an unused capability to block endpoint security solutions from loading user-mode code hooks via a DLL in a specified process by using the `UpdateProcThreadAttribute API` to set the `PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY` to `PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON` for an identified process.

PHASEJAM has modified Ivanti Connect Secure appliances and blocks the system upgrades by altering the DSUpgrade.pm file.

Clop can uninstall or disable security products.

Egregor has disabled Windows Defender to evade protections.

StealBit can configure processes to not display certain Windows error messages by through use of the `NtSetInformationProcess`.

ZxShell can kill AV products' processes.

SPAWNCHIMERA has modified the Ivanti Integrity Checker Tool to evade detection.

Ebury can disable SELinux Role-Based Access Control and deactivate PAM modules.

Meteor can attempt to uninstall Kaspersky Antivirus or remove the Kaspersky license; it can also add all files and folders related to the attack to the Windows Defender exclusion list.

ZIPLINE can add itself to the exclusion list for the Ivanti Connect Secure Integrity Checker Tool if the `--exclude` parameter is passed by the `tar` process.

Maze has disabled dynamic analysis and other security tools including IDA debugger, x32dbg, and OllyDbg. It has also disabled Windows Defender's Real-Time Monitoring feature and attempted to disable endpoint protection services.

ChChes can alter the victim's proxy configuration.

Shai-Hulud has replaced DNS configuration from `/tmp/resolved.conf` in order to gain control of network-level control within CI environments and has flushed iptables rules using `sudo iptables -F OUTPUT` and `sudo iptables -F DOCKER-USER`.

JPIN can lower security settings by changing Registry keys.

KOCTOPUS will attempt to delete or disable all Registry keys and scheduled tasks related to Microsoft Security Defender and Security Essentials.

Qilin can terminate antivirus-related processes and services.

LazyWiper can disable Microsoft Windows Defender Real-Time Monitoring with the `Set-MpPreference` cmdlet.

Agent Tesla has the capability to kill any running analysis processes and AV software.

POWERSTATS can disable Microsoft Office Protected View by changing Registry keys.

DRYHOOK has killed all instances of the `cgi-server` process in order for the modified Perl module to be activated.

Goopy has the ability to disable Microsoft Outlook's security policies to disable macro warnings.

QakBot has the ability to modify the Registry to add its binaries to the Windows Defender exclusion list.

SplatCloak has identified and disabled API callback features of Windows Defender and Kaspersky.

Waterbear can hook the ZwOpenProcess and GetExtendedTcpTable APIs called by the process of a security product to hide PIDs and TCP records from detection.

H1N1 kills and disables services for Windows Security Center, and Windows Defender.

WarzoneRAT can disarm Windows Defender during the UAC process to evade detection.

SILENTTRINITY's `amsiPatch.py` module can disable Antimalware Scan Interface (AMSI) functions.

DCRAT can patch Microsoft’s Antimalware Scan Interface (AMSI) to evade detection.

Brute Ratel C4 has the ability to hide memory artifacts and to patch Event Tracing for Windows (ETW) and the Anti Malware Scan Interface (AMSI).