Disable or Modify Tools
Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting ...
BY SOURCE
PROCEDURES (95)
Auto-extracted: 19 detections for general monitoring
Auto-extracted: 14 detections for process creation monitoring
Auto-extracted: 10 detections for registry monitoring
Auto-extracted: 9 detections for registry
Auto-extracted: 7 detections for powershell
Auto-extracted: 5 detections for ransomware
Auto-extracted: 5 detections for cloud monitoring
Auto-extracted: 4 detections for exfiltrat
Auto-extracted: 4 detections for driver
Auto-extracted: 4 detections for network connection monitoring
Auto-extracted: 4 detections for evasion
Auto-extracted: 4 detections for service
Auto-extracted: 4 detections for network connection monitoring
Auto-extracted: 4 detections for amsi
Auto-extracted: 3 detections for service
Auto-extracted: 3 detections for tamper
Auto-extracted: 3 detections for startup
Auto-extracted: 3 detections for script block
Auto-extracted: 3 detections for registry
Auto-extracted: 3 detections for suspicious
Auto-extracted: 3 detections for wmi
Auto-extracted: 3 detections for powershell
Auto-extracted: 3 detections for service
Auto-extracted: 3 detections for amsi
Auto-extracted: 3 detections for amsi
Auto-extracted: 3 detections for bypass
Auto-extracted: 2 detections for process access
Auto-extracted: 2 detections for driver
Auto-extracted: 2 detections for startup
Auto-extracted: 2 detections for service
Auto-extracted: 2 detections for amsi
Auto-extracted: 2 detections for kerbero
Auto-extracted: 2 detections for persist
Auto-extracted: 2 detections for suspicious
Auto-extracted: 2 detections for suspicious
Auto-extracted: 2 detections for tamper
Auto-extracted: 2 detections for tamper
Auto-extracted: 2 detections for suspicious
Auto-extracted: 2 detections for driver
Auto-extracted: 2 detections for wmi
Auto-extracted: 2 detections for event log
Auto-extracted: 2 detections for kerbero
Auto-extracted: 2 detections for scheduled task
Auto-extracted: 2 detections for wmi
Auto-extracted: 2 detections for event log
Auto-extracted: 2 detections for encrypt
Auto-extracted: 2 detections for kernel
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for process access monitoring
Auto-extracted: 1 detections for kernel
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for download
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for lsass
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for encrypt
Auto-extracted: 1 detections for kernel
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for lsass
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for process access
Auto-extracted: 1 detections for lsass
Auto-extracted: 1 detections for script execution monitoring
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for encrypt
Auto-extracted: 1 detections for evasion
Auto-extracted: 1 detections for kerbero
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for kernel
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for script execution monitoring
Auto-extracted: 1 detections for driver
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for evasion
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for service monitoring
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for kerbero
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for event log
Auto-extracted: 1 detections for lsass
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for wmi
Auto-extracted: 1 detections for api