Procedure examples

APT38 has unhooked DLLs to disable endpoint detection and response (EDR) or anti-virus (AV) tools.

Indrik Spider used PsExec to leverage Windows Defender to disable scanning of all downloaded files and to restrict real-time monitoring. Indrik Spider has used `MpCmdRun` to revert the definitions in Microsoft Defender. Additionally, Indrik Spider has used WMI to stop or uninstall and reset anti-virus products and other defensive services.

BlackByte disabled security tools such as Windows Defender and the Raccine anti-ransomware tool during operations.

Kimsuky has been observed turning off Windows Security Center and can hide the AV software window from the view of the infected user.

APT41 developed a custom injector that enables an Event Tracing for Windows (ETW) bypass, making malicious processes invisible to Windows logging.

Gorgon Group malware can attempt to disable security features in Microsoft Office and Windows Defender using the taskkill command.

MuddyWater can disable the system's local proxy settings.

FIN6 has deployed a utility script named kill.bat to disable anti-virus.

Gamaredon Group has delivered macros which can tamper with Microsoft Office security settings.

TeamTNT has disabled and uninstalled security tools such as Alibaba, Tencent, and BMC cloud monitoring agents on cloud-based infrastructure.

Rocke used scripts which detected and uninstalled antivirus software.

Scattered Spider has uninstalled and disabled security tools.

UNC3886 has disabled OpenSSL digital signature verification of system files through corruption of boot files.

Contagious Interview has convinced victims to disable Docker and other container environments and run code on their machine natively in attempts to bypass container isolation and ensure device infection.

TA2541 has attempted to disable built-in security protections such as Windows AMSI.

Akira has disabled or modified security tools for defense evasion.

Malware used by Putter Panda attempts to terminate processes corresponding to two components of Sophos Anti-Virus (SAVAdminService.exe and SavService.exe).

Aquatic Panda has attempted to stop endpoint detection and response (EDR) tools on compromised systems.

Saint Bear will modify registry entries and scheduled task objects associated with Windows Defender to disable its functionality.

Turla has used a AMSI bypass, which patches the in-memory amsi.dll, in PowerShell scripts to bypass Windows antimalware products.

TA505 has used malware to disable Windows Defender.

MirrorFace has disabled Windows Defender in compromised environments.

Medusa Group has terminated antivirus services utilizing the gaze.exe executable and utilizing `psexec.exe`. Medusa Group has also leveraged I/O control codes (IOCTLs) for terminating and deleting processes of identified security tools.

BRONZE BUTLER has incorporated code into several tools that attempts to terminate anti-virus processes.

Agrius used several mechanisms to try to disable security tools. Agrius attempted to modify EDR-related services to disable auto-start on system reboot. Agrius used a publicly available driver, GMER64.sys typically used for anti-rootkit functionality, to selectively stop and remove security software processes.

APT5 has used the CLEANPULSE utility to insert command line strings into a targeted process to prevent certain log events from occurring.

Lazarus Group malware TangoDelta attempts to terminate various processes associated with McAfee. Additionally, Lazarus Group malware SHARPKNOT disables the Microsoft Windows System Event Notification and Alerter services..

INC Ransom can use SystemSettingsAdminFlows.exe, a native Windows utility, to disable Windows Defender.

Wizard Spider has shut down or uninstalled security applications on victim systems that might prevent ransomware from executing.

Velvet Ant attempted to disable local security tools and endpoint detection and response (EDR) software during operations.

Play has used tools including GMER, IOBit, and PowerTool to disable antivirus software.

Magic Hound has disabled antivirus services on targeted systems in order to upload malicious payloads.