Technique:  Impair Defenses:Disable or Modify Tools
During the 2015 Ukraine Electric Power Attack, It modified in-registry internet settings to lower internet security.
Agent Tesla has the capability to kill any running analysis processes and AV software.
It has disabled Purview Audit on targeted accounts prior to stealing emails from  Microsoft 365 tenants.
It has attempted to stop endpoint detection and response (EDR) tools on compromised systems.
Avaddon looks for and attempts to stop anti-malware solutions.
Babuk can stop anti-virus services on a compromised host.
Bazar has manually loaded ntdll from disk in order to identity and remove API hooks set by security products.
Brave Prince terminates antimalware processes.
It has incorporated code into several tools that attempts to terminate anti-virus processes.
Bundlore can change browser security settings to enable extensions to be installed. Bundlore uses the pkill cfprefsd command to prevent users from inspecting processes.
Carberp has attempted to disable security software by creating a suspended process for the security software and injecting code to delete antivirus core files when the process is resumed.
ChChes can alter the victim's proxy configuration.
Clop can uninstall or disable security products.
Cobalt Strike has the ability to use Smart Applet attacks to disable the Java SecurityManager sandbox.
Conficker terminates various services related to system security and Windows.
DarkComet can disable Security Center functions like anti-virus.
Diavol can attempt to stop security software.
Donut can patch Antimalware Scan Interface (AMSI), Windows Lockdown Policy (WLDP), as well as exit-related Native API functions to avoid process termination.
Ebury can disable SELinux Role-Based Access Control and deactivate PAM modules.
Egregor has disabled Windows Defender to evade protections.
EKANS stops processes related to security and management software.
It has executed a batch script designed to disable Windows Defender on a compromised host.
It has deployed a utility script named kill.bat to disable anti-virus.
It has delivered macros which can tamper with Microsoft Office security settings.
Gold Dragon terminates anti-malware processes if they’re found running on the system.
Goopy has the ability to disable Microsoft Outlook's security policies to disable macro warnings.
It malware can attempt to disable security features in Microsoft Office and Windows Defender using the taskkill command.
Grandoreiro can hook APIs, kill processes, break file system paths, and change ACLs to prevent security tools from running.
H1N1 kills and disables services for Windows Security Center, and Windows Defender.
HDoor kills anti-virus found on the victim.
Hildegard has modified DNS resolvers to evade DNS monitoring tools.
Imminent Monitor has a feature to disable Windows Task Manager.
It used PsExec to leverage Windows Defender to disable scanning of all downloaded files and to restrict real-time monitoring.
JPIN can lower security settings by changing Registry keys.
It has been observed turning off Windows Security Center and can hide the AV software window from the view of the infected user.
KOCTOPUS will attempt to delete or disable all Registry keys and scheduled tasks related to Microsoft Security Defender and Security Essentials.
It malware TangoDelta attempts to terminate various processes associated with McAfee. Additionally, It malware SHARPKNOT disables the Microsoft Windows System Event Notification and Alerter services..
LockerGoga installation has been immediately preceded by a "task kill" command in order to disable anti-virus.
macOS.OSAMiner has searched for the Activity Monitor process in the System Events process list and kills the process if running. macOS.OSAMiner also searches the operating system's install.log for apps matching its hardcoded list, killing all matching process names.
It has disabled antivirus services on targeted systems in order to upload malicious payloads.
Maze has disabled dynamic analysis and other security tools including IDA debugger, x32dbg, and OllyDbg. It has also disabled Windows Defender's Real-Time Monitoring feature and attempted to disable endpoint protection services.
MegaCortex was used to kill endpoint security processes.
Metamorfo has a function to kill processes associated with defenses and can prevent certain processes from launching.
Meteor can attempt to uninstall Kaspersky Antivirus or remove the Kaspersky license; it can also add all files and folders related to the attack to the Windows Defender exclusion list.
It can disable the system's local proxy settings.
NanHaiShu can change Internet Explorer settings to reduce warnings about malware activity.
NanoCore can modify the victim's anti-virus.
Netwalker can detect and terminate active security software-related processes on infected systems.
During Night Dragon, threat actors disabled anti-virus and anti-spyware tools in some instances on the victim’s machines. The actors also disabled proxy settings to allow direct communication from victims to the Internet.
POWERSTATS can disable Microsoft Office Protected View by changing Registry keys.
Proton kills security tools like Wireshark that are running.
Malware used by It attempts to terminate processes corresponding to two components of Sophos Anti-Virus (SAVAdminService.exe and SavService.exe).
Pysa has the capability to stop antivirus services and disable Windows Defender.
QakBot has the ability to modify the Registry to add its binaries to the Windows Defender exclusion list.
Ragnar Locker has attempted to terminate/stop processes and services associated with endpoint security products.
REvil can connect to and disable the Symantec server on the victim's network.
RobbinHood will search for Windows services that are associated with antivirus software on the system and kill the process.
It used scripts which detected and uninstalled antivirus software.
RunningRAT kills antimalware running process.
Ryuk has stopped services related to anti-virus.
SILENTTRINITY's amsiPatch.py module can disable Antimalware Scan Interface (AMSI) functions.
Skidmap has the ability to set SELinux to permissive mode.
During the SolarWinds Compromise, It used the service control manager on a remote system to disable services associated with security monitoring products.
SslMM identifies and kills anti-malware processes.
StrongPity can add directories used by the malware to the Windows Defender exclusions list to prevent detection.
SUNBURST attempted to disable software security services following checks against a FNV-1a + XOR hashed hardcoded blocklist.
It  has attempted to disable built-in security protections such as Windows AMSI.
It has used malware to disable Windows Defender.
It has disabled and uninstalled security tools such as Alibaba, Tencent, and BMC cloud monitoring agents on cloud-based infrastructure.
ThiefQuest uses the function kill_unwanted to obtain a list of running processes and kills each process matching a list of security related processes.
TinyZBot can disable Avira anti-virus.
TrickBot can disable Windows Defender.
It has used a AMSI bypass, which patches the in-memory amsi.dll, in PowerShell scripts to bypass Windows antimalware products.
Unknown Logger has functionality to disable security tools, including Kaspersky, BitDefender, and MalwareBytes.
WarzoneRAT can disarm Windows Defender during the UAC process to evade detection.
WhisperGate can download and execute AdvancedRun.exe to disable the Windows Defender Theat Protection service and set an exclusion path for the C:\ drive.
It has shut down or uninstalled security applications on victim systems that might prevent ransomware from executing.
ZxShell can kill AV products' processes.