Procedure examples

TeamPCP impersonated legitimate maintainers to push imposter commits to the Aquasecurity Trivy scanner GitHub repository.

APT38 has unhooked DLLs to disable endpoint detection and response (EDR) or anti-virus (AV) tools.

Indrik Spider used PsExec to leverage Windows Defender to disable scanning of all downloaded files and to restrict real-time monitoring. Indrik Spider has used `MpCmdRun` to revert the definitions in Microsoft Defender. Additionally, Indrik Spider has used WMI to stop or uninstall and reset anti-virus products and other defensive services.

BlackByte disabled security tools such as Windows Defender and the Raccine anti-ransomware tool during operations.

Kimsuky has been observed turning off Windows Security Center and can hide the AV software window from the view of the infected user.

APT41 developed a custom injector that enables an Event Tracing for Windows (ETW) bypass, making malicious processes invisible to Windows logging.

Gorgon Group malware can attempt to disable security features in Microsoft Office and Windows Defender using the taskkill command.

MuddyWater can disable the system's local proxy settings.

FIN6 has deployed a utility script named kill.bat to disable anti-virus.

Gamaredon Group has delivered macros which can tamper with Microsoft Office security settings.

TeamTNT has disabled and uninstalled security tools such as Alibaba, Tencent, and BMC cloud monitoring agents on cloud-based infrastructure.

Rocke used scripts which detected and uninstalled antivirus software.

Scattered Spider has uninstalled and disabled security tools.

UNC3886 has disabled OpenSSL digital signature verification of system files through corruption of boot files.

Contagious Interview has convinced victims to disable Docker and other container environments and run code on their machine natively in attempts to bypass container isolation and ensure device infection.

TA2541 has attempted to disable built-in security protections such as Windows AMSI.

Akira has disabled or modified security tools for defense evasion.

Malware used by Putter Panda attempts to terminate processes corresponding to two components of Sophos Anti-Virus (SAVAdminService.exe and SavService.exe).

Aquatic Panda has attempted to stop endpoint detection and response (EDR) tools on compromised systems.

Saint Bear will modify registry entries and scheduled task objects associated with Windows Defender to disable its functionality.

Turla has used a AMSI bypass, which patches the in-memory amsi.dll, in PowerShell scripts to bypass Windows antimalware products.

TA505 has used malware to disable Windows Defender.

MirrorFace has disabled Windows Defender in compromised environments.

Medusa Group has terminated antivirus services utilizing the gaze.exe executable and utilizing `psexec.exe`. Medusa Group has also leveraged I/O control codes (IOCTLs) for terminating and deleting processes of identified security tools.

BRONZE BUTLER has incorporated code into several tools that attempts to terminate anti-virus processes.

Agrius used several mechanisms to try to disable security tools. Agrius attempted to modify EDR-related services to disable auto-start on system reboot. Agrius used a publicly available driver, GMER64.sys typically used for anti-rootkit functionality, to selectively stop and remove security software processes.

APT5 has used the CLEANPULSE utility to insert command line strings into a targeted process to prevent certain log events from occurring.

Lazarus Group malware TangoDelta attempts to terminate various processes associated with McAfee. Additionally, Lazarus Group malware SHARPKNOT disables the Microsoft Windows System Event Notification and Alerter services..

INC Ransom can use SystemSettingsAdminFlows.exe, a native Windows utility, to disable Windows Defender.

Wizard Spider has shut down or uninstalled security applications on victim systems that might prevent ransomware from executing.

Velvet Ant attempted to disable local security tools and endpoint detection and response (EDR) software during operations.

Play has used tools including GMER, IOBit, and PowerTool to disable antivirus software.

Magic Hound has disabled antivirus services on targeted systems in order to upload malicious payloads.

Magic Hound has executed scripts to disable the event log service.

Threat Group-3390 has used appcmd.exe to disable logging on a victim server.

APT29 has disabled Purview Audit on targeted accounts prior to stealing emails from Microsoft 365 tenants.

APT38 clears Window Event logs and Sysmon logs from the system.

Indrik Spider has used Cobalt Strike to empty log files. Additionally, Indrik Spider has cleared all event logs using `wevutil`.

Volt Typhoon has selectively cleared Windows Event Logs, system logs, and other technical artifacts to remove evidence of intrusion activity.

APT41 attempted to remove evidence of some of its activity by clearing Windows security and system events.

Dragonfly has cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys.

APT32 has cleared select event log entries.

HAFNIUM has cleared actor-performed actions from logs.

Aquatic Panda clears Windows Event Logs following activity to evade defenses.

FIN5 has cleared event logs from victims.

Chimera has cleared event logs on compromised hosts.

MirrorFace has deleted Windows event logs.

APT28 has cleared event logs, including by using the commands wevtutil cl System and wevtutil cl Security.

Play has used tools to remove log files on targeted systems.

FIN8 has cleared logs during post compromise cleanup activities.