T1685: Disable or Modify Tools

Description

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.(Citation: SCADAfence_ransomware)

In addition to directly targeting tools, adversaries may block or manipulate indicators and telemetry used for detection. This includes maliciously disabling or redirecting sensors such as Event Tracing for Windows (ETW), modifying event log configurations (e.g., redirecting Security logs), or interfering with logging pipelines and forwarding mechanisms (e.g., SIEM ingestion).(Citation: Microsoft Lamin Sept 2017)(Citation: ETW Palantir)

More advanced techniques include leveraging legitimate drivers or debugging mechanisms to render tools non-functional, bypassing anti-tampering protections, and targeting specific defenses such as Sysmon or cloud monitoring agents. Adversaries may also disrupt broader defensive operations, including update mechanisms, logging infrastructure (e.g., syslog), or event aggregation, further degrading an organization’s ability to detect and respond to malicious activity.(Citation: Cocomazzi FIN7 Reboot)

Platforms

ContainersESXiIaaSLinuxmacOSNetwork DevicesWindows

Sub-Techniques (6)

T1685.001

Clear Linux or Mac System Logs

Mitigations (7)

Execution PreventionM1038

Use application control where appropriate, especially regarding the execution of tools outside of the organization's security policies (such as rootkit removal tools) that have been abused to impair system defenses. Ensure that only approved security applications are used and running on enterprise systems.

User Account ManagementM1018

Ensure proper user permissions are in place to prevent adversaries from disabling or interfering with security services.

Restrict File and Directory PermissionsM1022

Ensure proper process and file permissions are in place to prevent adversaries from disabling or interfering with security services.

Restrict Registry PermissionsM1024

Ensure proper Registry permissions are in place to prevent adversaries from disabling or interfering with security services.

Software ConfigurationM1054

Consider automatically relaunching forwarding mechanisms at recurring intervals (ex: temporal, on-logon, etc.) as well as applying appropriate change management to firewall rules and other related system configurations.

AuditM1047

Periodically verify that tools are functioning appropriately – for example, that all expected hosts with EDRs or monitoring agents are checking in to the central console. Check EDRs to ensure that no unexpected exclusion paths have been added. In Microsoft Defender for Endpoint, exclusions can be reviewed with the Get-MpPreference cmdlet.(Citation: CodeX Microsoft Defender 2021)

Disable or Remove Feature or ProgramM1042

Consider removing previous versions of tools that are unnecessary to the environment when possible.

Threat Groups (32)

ID	Group	Context
G0082	APT38	[APT38](https://attack.mitre.org/groups/G0082) has unhooked DLLs to disable endpoint detection and response (EDR) or anti-virus (AV) tools.(Citation: ...
G0119	Indrik Spider	[Indrik Spider](https://attack.mitre.org/groups/G0119) used [PsExec](https://attack.mitre.org/software/S0029) to leverage Windows Defender to disable ...
G1043	BlackByte	[BlackByte](https://attack.mitre.org/groups/G1043) disabled security tools such as Windows Defender and the Raccine anti-ransomware tool during operat...
G0094	Kimsuky	[Kimsuky](https://attack.mitre.org/groups/G0094) has been observed turning off Windows Security Center and can hide the AV software window from the vi...
G0096	APT41	[APT41](https://attack.mitre.org/groups/G0096) developed a custom injector that enables an Event Tracing for Windows (ETW) bypass, making malicious pr...
G0078	Gorgon Group	[Gorgon Group](https://attack.mitre.org/groups/G0078) malware can attempt to disable security features in Microsoft Office and Windows Defender using ...
G0069	MuddyWater	[MuddyWater](https://attack.mitre.org/groups/G0069) can disable the system's local proxy settings.(Citation: Trend Micro Muddy Water March 2021)
G0037	FIN6	[FIN6](https://attack.mitre.org/groups/G0037) has deployed a utility script named <code>kill.bat</code> to disable anti-virus.(Citation: FireEye FIN6 ...
G0047	Gamaredon Group	[Gamaredon Group](https://attack.mitre.org/groups/G0047) has delivered macros which can tamper with Microsoft Office security settings.(Citation: ESET...
G0139	TeamTNT	[TeamTNT](https://attack.mitre.org/groups/G0139) has disabled and uninstalled security tools such as Alibaba, Tencent, and BMC cloud monitoring agents...
G0106	Rocke	[Rocke](https://attack.mitre.org/groups/G0106) used scripts which detected and uninstalled antivirus software.(Citation: Talos Rocke August 2018)(Cita...
G1015	Scattered Spider	[Scattered Spider](https://attack.mitre.org/groups/G1015) has uninstalled and disabled security tools.(Citation: Mandiant UNC3944 May 2025)
G1048	UNC3886	[UNC3886](https://attack.mitre.org/groups/G1048) has disabled OpenSSL digital signature verification of system files through corruption of boot files....
G1052	Contagious Interview	[Contagious Interview](https://attack.mitre.org/groups/G1052) has convinced victims to disable Docker and other container environments and run code on...
G1018	TA2541	[TA2541](https://attack.mitre.org/groups/G1018) has attempted to disable built-in security protections such as Windows AMSI. (Citation: Proofpoint TA...
G1024	Akira	[Akira](https://attack.mitre.org/groups/G1024) has disabled or modified security tools for defense evasion.(Citation: Cisco Akira Ransomware OCT 2024)
G0024	Putter Panda	Malware used by [Putter Panda](https://attack.mitre.org/groups/G0024) attempts to terminate processes corresponding to two components of Sophos Anti-V...
G0143	Aquatic Panda	[Aquatic Panda](https://attack.mitre.org/groups/G0143) has attempted to stop endpoint detection and response (EDR) tools on compromised systems.(Citat...
G1031	Saint Bear	[Saint Bear](https://attack.mitre.org/groups/G1031) will modify registry entries and scheduled task objects associated with Windows Defender to disabl...
G0010	Turla	[Turla](https://attack.mitre.org/groups/G0010) has used a AMSI bypass, which patches the in-memory amsi.dll, in PowerShell scripts to bypass Windows a...

Associated Software (87)

ID	Name	Type	Context
S0061	HDoor	Malware	[HDoor](https://attack.mitre.org/software/S0061) kills anti-virus found on the victim.(Citation: Baumgartner Naikon 2015)
S0266	TrickBot	Malware	[TrickBot](https://attack.mitre.org/software/S0266) can disable Windows Defender.(Citation: Trend Micro Trickbot Nov 2018)
S0605	EKANS	Malware	[EKANS](https://attack.mitre.org/software/S0605) stops processes related to security and management software.(Citation: Dragos EKANS)(Citation: FireEy...
S1206	JumbledPath	Malware	[JumbledPath](https://attack.mitre.org/software/S1206) can impair logging on all devices used along its connection path to compromised hosts.(Citation...
S0603	Stuxnet	Malware	[Stuxnet](https://attack.mitre.org/software/S0603) reduces the integrity level of objects to allow write actions.(Citation: Nicolas Falliere, Liam O M...
S0400	RobbinHood	Malware	[RobbinHood](https://attack.mitre.org/software/S0400) will search for Windows services that are associated with antivirus software on the system and k...
S0491	StrongPity	Malware	[StrongPity](https://attack.mitre.org/software/S0491) can add directories used by the malware to the Windows Defender exclusions list to prevent detec...
S0252	Brave Prince	Malware	[Brave Prince](https://attack.mitre.org/software/S0252) terminates antimalware processes.(Citation: McAfee Gold Dragon)
S1244	Medusa Ransomware	Malware	[Medusa Ransomware](https://attack.mitre.org/software/S1244) has terminated antivirus services utilizing the gaze.exe executable.(Citation: Palo Alto ...
S1048	macOS.OSAMiner	Malware	[macOS.OSAMiner](https://attack.mitre.org/software/S1048) has searched for the Activity Monitor process in the System Events process list and kills th...
S0058	SslMM	Malware	[SslMM](https://attack.mitre.org/software/S0058) identifies and kills anti-malware processes.(Citation: Baumgartner Naikon 2015)
S1184	BOLDMOVE	Malware	[BOLDMOVE](https://attack.mitre.org/software/S1184) can disable the Fortinet daemons `moglogd` and `syslogd` to evade detection and logging.(Citation:...
S1065	Woody RAT	Malware	[Woody RAT](https://attack.mitre.org/software/S1065) has suppressed all error reporting by calling `SetErrorMode` with 0x8007 as a parameter.(Citation...
S1178	ShrinkLocker	Malware	[ShrinkLocker](https://attack.mitre.org/software/S1178) disables protectors used to secure the BitLocker encryption key on victim systems.(Citation: K...
S0601	Hildegard	Malware	[Hildegard](https://attack.mitre.org/software/S0601) has modified DNS resolvers to evade DNS monitoring tools.(Citation: Unit 42 Hildegard Malware)
S0689	WhisperGate	Malware	[WhisperGate](https://attack.mitre.org/software/S0689) can download and execute AdvancedRun.exe to disable the Windows Defender Theat Protection servi...
S0468	Skidmap	Malware	[Skidmap](https://attack.mitre.org/software/S0468) has the ability to set SELinux to permissive mode.(Citation: Trend Micro Skidmap)
S1130	Raspberry Robin	Malware	[Raspberry Robin](https://attack.mitre.org/software/S1130) can add an exception to Microsoft Defender that excludes the entire main drive from anti-ma...
S0659	Diavol	Malware	[Diavol](https://attack.mitre.org/software/S0659) can attempt to stop security software.(Citation: Fortinet Diavol July 2021)
S0334	DarkComet	Malware	[DarkComet](https://attack.mitre.org/software/S0334) can disable Security Center functions like anti-virus.(Citation: TrendMicro DarkComet Sept 2014)(...

References

Frequently Asked Questions

What is T1685 (Disable or Modify Tools)?

T1685 is a MITRE ATT&CK technique named 'Disable or Modify Tools'. It belongs to the Defense Impairment tactic(s). Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensor...

How can T1685 be detected?

Detection of T1685 (Disable or Modify Tools) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.

What mitigations exist for T1685?

There are 7 documented mitigations for T1685. Key mitigations include: Execution Prevention, User Account Management, Restrict File and Directory Permissions, Restrict Registry Permissions, Software Configuration.

Which threat groups use T1685?

Known threat groups using T1685 include: APT38, Indrik Spider, BlackByte, Kimsuky, APT41, Gorgon Group, MuddyWater, FIN6.