Disable or Modify Tools

ID: T1685
Tactics: TA0112 Defense Impairment
Platforms: Containers, ESXi, IaaS, Linux, macOS, Network Devices, Windows
Data sources: Service Creation, Process Termination, Windows Registry Key Modification, Process Creation, Service Metadata, Cloud Service Modification, Host Status, Command Execution, Service Modification
Source: attack.mitre.org
MITRE last modified: 12 Sep 2026

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.^[2]

In addition to directly targeting tools, adversaries may block or manipulate indicators and telemetry used for detection. This includes maliciously disabling or redirecting sensors such as Event Tracing for Windows (ETW), modifying event log configurations (e.g., redirecting Security logs), or interfering with logging pipelines and forwarding mechanisms (e.g., SIEM ingestion).^[3]^[4]

More advanced techniques include leveraging legitimate drivers or debugging mechanisms to render tools non-functional, bypassing anti-tampering protections, and targeting specific defenses such as Sysmon or cloud monitoring agents. Adversaries may also disrupt broader defensive operations, including update mechanisms, logging infrastructure (e.g., syslog), or event aggregation, further degrading an organization’s ability to detect and respond to malicious activity.^[5]

Sub-techniques (7)

Detection

DET0497 Detection of Defense Impairment through Disabled or Modified Tools across OS Platforms.
Data components: Service Creation, Process Termination, Windows Registry Key Modification, Process Creation, Service Metadata, Cloud Service Modification, Host Status, Command Execution, Service Modification

Mitigations (7)

M1018 User Account Management: Ensure proper user permissions are in place to prevent adversaries from disabling or interfering with security services.
M1022 Restrict File and Directory Permissions: Ensure proper process and file permissions are in place to prevent adversaries from disabling or interfering with security services.
M1024 Restrict Registry Permissions: Ensure proper Registry permissions are in place to prevent adversaries from disabling or interfering with security services.
M1038 Execution Prevention: Use application control where appropriate, especially regarding the execution of tools outside of the organization's security policies (such as rootkit removal tools) that have been abused to impair system defenses. Ensure that only approved security applications are used and running on enterprise systems.
M1042 Disable or Remove Feature or Program: Consider removing previous versions of tools that are unnecessary to the environment when possible.
M1047 Audit: Periodically verify that tools are functioning appropriately – for example, that all expected hosts with EDRs or monitoring agents are checking in to the central console. Check EDRs to ensure that no unexpected exclusion paths have been added. In Microsoft Defender for Endpoint, exclusions can be reviewed with the Get-MpPreference cmdlet.^[1]
M1054 Software Configuration: Consider automatically relaunching forwarding mechanisms at recurring intervals (ex: temporal, on-logon, etc.) as well as applying appropriate change management to firewall rules and other related system configurations.

Groups (33)

Software (89)

Showing 60 of 89. Full list on attack.mitre.org.