# T1685 - Disable or Modify Tools

## Description from ATT&CK

> Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.(Citation: SCADAfence_ransomware)
> 
> In addition to directly targeting tools, adversaries may block or manipulate indicators and telemetry used for detection. This includes maliciously disabling or redirecting sensors such as Event Tracing for Windows (ETW), modifying event log configurations (e.g., redirecting Security logs), or interfering with logging pipelines and forwarding mechanisms (e.g., SIEM ingestion).(Citation: Microsoft Lamin Sept 2017)(Citation: ETW Palantir)
> 
> More advanced techniques include leveraging legitimate drivers or debugging mechanisms to render tools non-functional, bypassing anti-tampering protections, and targeting specific defenses such as Sysmon or cloud monitoring agents. Adversaries may also disrupt broader defensive operations, including update mechanisms, logging infrastructure (e.g., syslog), or event aggregation, further degrading an organization’s ability to detect and respond to malicious activity.(Citation: Cocomazzi FIN7 Reboot)

[Source](https://attack.mitre.org/techniques/T1685)

## Atomic Tests

- [Atomic Test #1: Windows Disable LSA Protection](#atomic-test-1-windows-disable-lsa-protection)
- [Atomic Test #2: Disable journal logging via systemctl utility](#atomic-test-2-disable-journal-logging-via-systemctl-utility)
- [Atomic Test #3: Disable journal logging via sed utility](#atomic-test-3-disable-journal-logging-via-sed-utility)
- [Atomic Test #4: Disable syslog](#atomic-test-4-disable-syslog)
- [Atomic Test #5: Disable syslog (freebsd)](#atomic-test-5-disable-syslog-freebsd)
- [Atomic Test #6: Disable Cb Response](#atomic-test-6-disable-cb-response)
- [Atomic Test #7: Disable SELinux](#atomic-test-7-disable-selinux)
- [Atomic Test #8: Stop Crowdstrike Falcon on Linux](#atomic-test-8-stop-crowdstrike-falcon-on-linux)
- [Atomic Test #9: Disable Carbon Black Response](#atomic-test-9-disable-carbon-black-response)
- [Atomic Test #10: Disable LittleSnitch](#atomic-test-10-disable-littlesnitch)
- [Atomic Test #11: Disable OpenDNS Umbrella](#atomic-test-11-disable-opendns-umbrella)
- [Atomic Test #12: Disable macOS Gatekeeper](#atomic-test-12-disable-macos-gatekeeper)
- [Atomic Test #13: Stop and unload Crowdstrike Falcon on macOS](#atomic-test-13-stop-and-unload-crowdstrike-falcon-on-macos)
- [Atomic Test #14: Unload Sysmon Filter Driver](#atomic-test-14-unload-sysmon-filter-driver)
- [Atomic Test #15: Uninstall Sysmon](#atomic-test-15-uninstall-sysmon)
- [Atomic Test #16: AMSI Bypass - AMSI InitFailed](#atomic-test-16-amsi-bypass---amsi-initfailed)
- [Atomic Test #17: AMSI Bypass - Remove AMSI Provider Reg Key](#atomic-test-17-amsi-bypass---remove-amsi-provider-reg-key)
- [Atomic Test #18: Disable Arbitrary Security Windows Service](#atomic-test-18-disable-arbitrary-security-windows-service)
- [Atomic Test #19: Tamper with Windows Defender ATP PowerShell](#atomic-test-19-tamper-with-windows-defender-atp-powershell)
- [Atomic Test #20: Tamper with Windows Defender Command Prompt](#atomic-test-20-tamper-with-windows-defender-command-prompt)
- [Atomic Test #21: Tamper with Windows Defender Registry](#atomic-test-21-tamper-with-windows-defender-registry)
- [Atomic Test #22: Disable Microsoft Office Security Features](#atomic-test-22-disable-microsoft-office-security-features)
- [Atomic Test #23: Remove Windows Defender Definition Files](#atomic-test-23-remove-windows-defender-definition-files)
- [Atomic Test #24: Stop and Remove Arbitrary Security Windows Service](#atomic-test-24-stop-and-remove-arbitrary-security-windows-service)
- [Atomic Test #25: Uninstall Crowdstrike Falcon on Windows](#atomic-test-25-uninstall-crowdstrike-falcon-on-windows)
- [Atomic Test #26: Tamper with Windows Defender Evade Scanning -Folder](#atomic-test-26-tamper-with-windows-defender-evade-scanning--folder)
- [Atomic Test #27: Tamper with Windows Defender Evade Scanning -Extension](#atomic-test-27-tamper-with-windows-defender-evade-scanning--extension)
- [Atomic Test #28: Tamper with Windows Defender Evade Scanning -Process](#atomic-test-28-tamper-with-windows-defender-evade-scanning--process)
- [Atomic Test #29: office-365-Disable-AntiPhishRule](#atomic-test-29-office-365-disable-antiphishrule)
- [Atomic Test #30: Disable Windows Defender with DISM](#atomic-test-30-disable-windows-defender-with-dism)
- [Atomic Test #31: Disable Defender Using NirSoft AdvancedRun](#atomic-test-31-disable-defender-using-nirsoft-advancedrun)
- [Atomic Test #32: Kill antimalware protected processes using Backstab](#atomic-test-32-kill-antimalware-protected-processes-using-backstab)
- [Atomic Test #33: WinPwn - Kill the event log services for stealth](#atomic-test-33-winpwn---kill-the-event-log-services-for-stealth)
- [Atomic Test #34: Tamper with Windows Defender ATP using Aliases - PowerShell](#atomic-test-34-tamper-with-windows-defender-atp-using-aliases---powershell)
- [Atomic Test #35: LockBit Black - Disable Privacy Settings Experience Using Registry -cmd](#atomic-test-35-lockbit-black---disable-privacy-settings-experience-using-registry--cmd)
- [Atomic Test #36: LockBit Black - Use Registry Editor to turn on automatic logon -cmd](#atomic-test-36-lockbit-black---use-registry-editor-to-turn-on-automatic-logon--cmd)
- [Atomic Test #37: LockBit Black - Disable Privacy Settings Experience Using Registry -Powershell](#atomic-test-37-lockbit-black---disable-privacy-settings-experience-using-registry--powershell)
- [Atomic Test #38: Lockbit Black - Use Registry Editor to turn on automatic logon -Powershell](#atomic-test-38-lockbit-black---use-registry-editor-to-turn-on-automatic-logon--powershell)
- [Atomic Test #39: Disable Windows Defender with PwSh Disable-WindowsOptionalFeature](#atomic-test-39-disable-windows-defender-with-pwsh-disable-windowsoptionalfeature)
- [Atomic Test #40: WMIC Tamper with Windows Defender Evade Scanning Folder](#atomic-test-40-wmic-tamper-with-windows-defender-evade-scanning-folder)
- [Atomic Test #41: Delete Windows Defender Scheduled Tasks](#atomic-test-41-delete-windows-defender-scheduled-tasks)
- [Atomic Test #42: Clear History](#atomic-test-42-clear-history)
- [Atomic Test #43: Suspend History](#atomic-test-43-suspend-history)
- [Atomic Test #44: Reboot Linux Host via Kernel System Request](#atomic-test-44-reboot-linux-host-via-kernel-system-request)
- [Atomic Test #45: Clear Pagging Cache]