Disable or Modify Tools `T1685`

Tactic: Defense Impairment

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.

Events covered

47 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 7	Image loaded
Sysmon	Event ID 10	ProcessAccess
Sysmon	Event ID 11	FileCreate
Sysmon	Event ID 12	RegistryEvent (Object create and delete)
Sysmon	Event ID 13	RegistryEvent (Value Set)
Sysmon	Event ID 14	RegistryEvent (Key and Value Rename)
Sysmon	Event ID 17	PipeEvent (Pipe Created)
Sysmon	Event ID 18	PipeEvent (Pipe Connected)
Security-Auditing	Event ID 4656	A handle to an object was requested.
Security-Auditing	Event ID 4657	A registry value was modified.
Security-Auditing	Event ID 4663	An attempt was made to access an object.
Security-Auditing	Event ID 4673	A privileged service was called.
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4719	System audit policy was changed.
Security-Auditing	Event ID 4720	A user account was created.
Security-Auditing	Event ID 4738	A user account was changed.
Security-Auditing	Event ID 5136	A directory service object was modified.
Security-Auditing	Event ID 5157	The Windows Filtering Platform has blocked a connection.
Security-Auditing	Event ID 5441	The following filter was present when the Windows Filtering Platform Base Filtering Engine started.
Security-Auditing	Event ID 5447	A Windows Filtering Platform filter has been changed.
Application-Error	Event ID 1000	Faulting application name: Faulting_application_name, version: version, time stamp: 0xFaulting_module_name.
Application-Popup	Event ID 26	Application popup: Caption : Message.
ESF	exec	Process Execution (Notify)
Linux-Auditd	Event ID 1300	SYSCALL
Linux-Auditd	Event ID 1302	PATH
Linux-Auditd	Event ID 1309	EXECVE
Eventlog	Event ID 104	The LogFileCleared.Channel log file was cleared.
Eventlog	Event ID 1100	The event logging service has shut down.
Eventlog	Event ID 1102	The audit log was cleared.
IIS-Configuration	Event ID 29	Changes to 'Configuration' at 'ConfigPath' have successfully been committed.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).
Windows-Defender	Event ID 1009	ProductName has restored an item from quarantine.
Windows-Defender	Event ID 1119	ProductName has encountered a critical error when taking action on malware or other potentially unwanted software.
Windows-Defender	Event ID 3002	ProductName Real-Time Protection feature has encountered an error and failed.
Windows-Defender	Event ID 3007	ProductName Real-time Protection feature has restarted.
Windows-Defender	Event ID 5001	Product Name Real-time Protection scanning for malware and other potentially unwanted software was disabled.
Windows-Defender	Event ID 5007	Product Name Configuration has changed.
Windows-Defender	Event ID 5010	ProductName scanning for spyware and other potentially unwanted software is disabled.
Windows-Defender	Event ID 5012	ProductName scanning for viruses is disabled.
Windows-Defender	Event ID 5013	Tamper Protection Changed Type a change to Product Name.
Windows-Defender	Event ID 5101	{Product Name} grace period has expired.
PowerShell	Event ID 600	Event ID 600
Service-Control-Manager	Event ID 7036	The Microsoft Software Shadow Copy Provider service entered the stopped state.
Service-Control-Manager	Event ID 7040	The start type of the msdsm service was changed from boot start to demand start.
Sysmon-for-Linux	Event ID 1	Process Create
Windows-Error-Reporting	Event ID 1001	Fault bucket , type.

Authoring guide

Patterns shared across the 359 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (106 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Field	Rules	How	Sample values
`CommandLine`	101	`contains` 93, `in` 14, `ends_with` 4, `match` 3, `regex_match` 1, `starts_with` 1	`add` , `add` , `delete` , `stop` , `/set`
`Details`	91	`eq` 74, `is_not_null` 23, `contains` 11, `in` 4, `ends_with` 1	`0x00000000`, `0x00000001`, `DWORD (0x00000000)`, `DWORD (0x00000001)`, `0`
`Image`	71	`ends_with` 65, `contains` 8, `starts_with` 7, `eq` 6, `is_null` 1	`\powershell.exe`, `\pwsh.exe`, `\reg.exe`, `\powershell_ise.exe`, `:\perflogs\`
`registry_path`	56	`ends_with` 34, `contains` 20, `in` 3	`\\microsoft\\windows defender\\spynet`, `\\policies\\microsoft\\windows defender`, `SecurityHealthService`, `WdBoot`, `WdFilter`
`OriginalFileName`	51	`eq` 51	`powershell.exe`, `pwsh.dll`, `reg.exe`, `auditpol.exe`, `powershell_ise.exe`
`sourcetype`	49	`eq` 44, `in` 5	`httpevent`, `aws:cloudtrail`, `aws:asl`, `vmw-syslog`, `vmware:esxlog*`
`TargetObject`	46	`contains` 26, `ends_with` 26, `eq` 4	`\software\microsoft\windows...`, `\control\keyboard layouts\`, `\deviceguard\enablevirtualizationbasedsecurity`, `\deviceguard\lsacfgflags`, `\microsoft\windows\currentversion\winevt\channels\`
`process_name`	33	`eq` 31, `ends_with` 2, `in` 1, `starts_with` 1	`auditpol.exe`, `sfc.exe`, `wevtutil.exe`, `powershell.exe`, `powershell_ise.exe`
`Channel`	22	`eq` 22, `in` 10
`aws::eventName`	19	`eq` 18, `in` 2	`DeleteDetector`, `DeleteTrail`, `StopLogging`, `UpdateTrail`, `DeleteIPSet`
`EventID`	17	`eq` 15, `in` 2	`4104`, `4719`, `5136`, `7040`, `10`
`registry_value_name`	17	`eq` 15, `in` 2	`DisableAntiSpyware`, `Start`, `COMPlus_ETWEnabled`, `ChannelAccess`, `CustomSD`
`action`	15	`eq` 14, `contains` 1	`Add`, `audit_log_streaming.update`, `audit_log_streaming.destroy`, `business.disable_two_factor_requirement`, `business_secret_scanning.disable`
`ScriptBlockText`	13	`contains` 12, `match` 2, `in` 1	`-exclusionextension` , `-exclusionipaddress` , `-exclusionpath` , `-xmlpolicy` , `#<null>`
`aws::eventSource`	12	`eq` 12, `in` 1	`cloudtrail.amazonaws.com`, `guardduty.amazonaws.com`, `bedrock.amazonaws.com`, `config.amazonaws.com`, `logs.amazonaws.com`

Top indicator values (2010 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Field	Kind	Value	Rules (here)	Corpus reach
`Details`	`eq`	`0x00000000` splunkDisable AMSI Through Registry splunkDisable Defender MpEngine Registry splunkDisable Defender Spynet Reporting splunkDisable Defender Submit Samples Consent Feature splunkDisable ETW Through Registry splunkDisable Show Hidden Files splunkETW Registry Disabled splunkHide User Account From Sign-In Screen splunkWindows Impair Defense Configure App Install Control splunkWindows Impair Defense Disable Controlled Folder Access splunkWindows Impair Defense Disable PUA Protection splunkWindows Impair Defense Disable Realtime Signature Delivery splunkWindows Impair Defense Disable Web Evaluation splunkWindows Impair Defense Disable Win Defender App Guard splunkWindows Impair Defense Disable Win Defender Compute File Hashes splunkWindows Impair Defense Disable Win Defender Network Protection splunkWindows Impair Defense Overide Win Defender Phishing Filter splunkWindows Impair Defense Override SmartScreen Prompt splunkWindows Impair Defenses Disable Auto Logger Session splunkWindows Impair Defenses Disable HVCI splunkWindows Impair Defenses Disable Win Defender Auto Logging	21	43
`Details`	`eq`	`0x00000001` splunkDisable Defender AntiVirus Registry splunkDisable Defender BlockAtFirstSeen Feature splunkDisable Defender Enhanced Notification splunkDisable Registry Tool splunkDisable Show Hidden Files splunkDisable Windows Behavior Monitoring splunkDisabling CMD Application splunkDisabling ControlPanel splunkDisabling FolderOptions Windows Feature splunkDisabling NoRun Windows App splunkDisabling Task Manager splunkWindows DisableAntiSpyware Registry splunkWindows Impair Defense Change Win Defender Health Check Intervals splunkWindows Impair Defense Change Win Defender Tracing Level splunkWindows Impair Defense Disable Defender Firewall And Network splunkWindows Impair Defense Disable Defender Protocol Recognition splunkWindows Impair Defense Disable Win Defender Gen reports splunkWindows Impair Defense Disable Win Defender Report Infection splunkWindows Impair Defense Disable Win Defender Scan On Update splunkWindows Impair Defense Disable Win Defender Signature Retirement	20	63
`Details`	`eq`	`DWORD (0x00000000)` sigmaAMSI Disabled via Registry Modification sigmaAntivirus Filter Driver Disallowed On Dev Drive - Registry sigmaDisable Privacy Settings Experience in Registry sigmaDisable PUA Protection on Windows Defender sigmaDisable Tamper Protection on Windows Defender sigmaDisable Windows Defender Functionalities Via Registry Keys sigmaDisable Windows Event Logging Via Registry sigmaDisabled Windows Defender Eventlog sigmaETW Logging Disabled For rpcrt4.dll sigmaETW Logging Disabled In .NET Processes - Sysmon Registry sigmaHide Schedule Task Via Index Value Tamper sigmaMicrosoft Office Protected View Disabled sigmaNetNTLM Downgrade Attack - Registry sigmaPotential AutoLogger Sessions Tampering sigmaTamper With Sophos AV Registry Keys sigmaWindows Credential Guard Disabled - Registry sigmaWindows Hypervisor Enforced Code Integrity Disabled sigmaWindows Vulnerable Driver Blocklist Disabled	18	38
`Details`	`eq`	`DWORD (0x00000001)` sigmaDisable Windows Defender Functionalities Via Registry Keys sigmaEnable Remote Connection Between Anonymous Computer - AllowAnonymousCallback sigmaETW Logging Disabled For SCM sigmaHypervisor Enforced Paging Translation Disabled sigmaMicrosoft Office Protected View Disabled sigmaNetNTLM Downgrade Attack - Registry sigmaPython Function Execution Security Warning Disabled In Excel - Registry sigmaScripted Diagnostics Turn Off Check Enabled - Registry	8	40
`Image`	`ends_with`	`\powershell.exe` sigmaDisable Windows Defender AV Security Monitoring sigmaHypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine sigmaObfuscated PowerShell OneLiner Execution sigmaSecurity Event Logging Disabled via MiniNt Registry Key - Process sigmaService StartupType Change Via PowerShell Set-Service sigmaSuspicious Eventlog Clearing or Configuration Change Activity sigmaSuspicious Uninstall of Windows Defender Feature via PowerShell sigmaSuspicious Windows Service Tampering sigmaVulnerable Driver Blocklist Registry Tampering Via CommandLine sigmaWindows AMSI Related Registry Tampering Via CommandLine sigmaWindows Credential Guard Registry Tampering Via CommandLine sigmaWindows Defender Context Menu Removed sigmaWindows EventLog Autologger Session Registry Modification Via CommandLine sigmaWindows Firewall Disabled via PowerShell	14	182
`Image`	`ends_with`	`\pwsh.exe` sigmaDisable Windows Defender AV Security Monitoring sigmaHypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine sigmaSecurity Event Logging Disabled via MiniNt Registry Key - Process sigmaSuspicious Eventlog Clearing or Configuration Change Activity sigmaSuspicious Uninstall of Windows Defender Feature via PowerShell sigmaSuspicious Windows Service Tampering sigmaVulnerable Driver Blocklist Registry Tampering Via CommandLine sigmaWindows AMSI Related Registry Tampering Via CommandLine sigmaWindows Credential Guard Registry Tampering Via CommandLine sigmaWindows Defender Context Menu Removed sigmaWindows EventLog Autologger Session Registry Modification Via CommandLine sigmaWindows Firewall Disabled via PowerShell	12	168
`Image`	`ends_with`	`\reg.exe` sigmaAdd SafeBoot Keys Via Reg Utility sigmaDisabling Windows Defender WMI Autologger Session via Reg.exe sigmaHypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine sigmaReg Add Suspicious Paths sigmaSecurity Event Logging Disabled via MiniNt Registry Key - Process sigmaSuspicious Windows Defender Folder Exclusion Added Via Reg.EXE sigmaSuspicious Windows Defender Registry Key Tampering Via Reg.EXE sigmaVulnerable Driver Blocklist Registry Tampering Via CommandLine sigmaWindows AMSI Related Registry Tampering Via CommandLine sigmaWindows Credential Guard Registry Tampering Via CommandLine sigmaWindows Defender Context Menu Removed sigmaWindows EventLog Autologger Session Registry Modification Via CommandLine	12	58
`Image`	`ends_with`	`\powershell_ise.exe` sigmaSecurity Event Logging Disabled via MiniNt Registry Key - Process sigmaSuspicious Eventlog Clearing or Configuration Change Activity sigmaSuspicious Uninstall of Windows Defender Feature via PowerShell sigmaSuspicious Windows Service Tampering sigmaWindows Defender Context Menu Removed sigmaWindows Firewall Disabled via PowerShell	6	41
`Image`	`ends_with`	`\msmpeng.exe` sigmaDisable Tamper Protection on Windows Defender sigmaHackTool - SysmonEnte Execution sigmaPotential AutoLogger Sessions Tampering sigmaRemoval Of AMSI Provider Registry Keys sigmaWindows Filtering Platform Blocked Connection From EDR Agent Binary	5	2
`OriginalFileName`	`eq`	`powershell.exe` sigmaDisable Windows Defender AV Security Monitoring sigmaHypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine sigmaSecurity Event Logging Disabled via MiniNt Registry Key - Process sigmaService StartupType Change Via PowerShell Set-Service sigmaSuspicious Uninstall of Windows Defender Feature via PowerShell sigmaSuspicious Windows Service Tampering sigmaVulnerable Driver Blocklist Registry Tampering Via CommandLine sigmaWindows AMSI Related Registry Tampering Via CommandLine sigmaWindows Credential Guard Registry Tampering Via CommandLine sigmaWindows Defender Context Menu Removed sigmaWindows EventLog Autologger Session Registry Modification Via CommandLine sigmaWindows Firewall Disabled via PowerShell splunkPowershell Disable Security Monitoring splunkWindows Impair Defense Add Xml Applocker Rules	14	120
`OriginalFileName`	`eq`	`pwsh.dll` sigmaDisable Windows Defender AV Security Monitoring sigmaHypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine sigmaSecurity Event Logging Disabled via MiniNt Registry Key - Process sigmaSuspicious Uninstall of Windows Defender Feature via PowerShell sigmaSuspicious Windows Service Tampering sigmaVulnerable Driver Blocklist Registry Tampering Via CommandLine sigmaWindows AMSI Related Registry Tampering Via CommandLine sigmaWindows Credential Guard Registry Tampering Via CommandLine sigmaWindows Defender Context Menu Removed sigmaWindows EventLog Autologger Session Registry Modification Via CommandLine sigmaWindows Firewall Disabled via PowerShell splunkPowershell Disable Security Monitoring splunkWindows Impair Defense Add Xml Applocker Rules	13	112
`OriginalFileName`	`eq`	`reg.exe` sigmaAdd SafeBoot Keys Via Reg Utility sigmaDisabling Windows Defender WMI Autologger Session via Reg.exe sigmaHypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine sigmaReg Add Suspicious Paths sigmaSafeBoot Registry Key Deleted Via Reg.EXE sigmaSecurity Event Logging Disabled via MiniNt Registry Key - Process sigmaService Registry Key Deleted Via Reg.EXE sigmaSuspicious Windows Defender Registry Key Tampering Via Reg.EXE sigmaVulnerable Driver Blocklist Registry Tampering Via CommandLine sigmaWindows AMSI Related Registry Tampering Via CommandLine sigmaWindows Credential Guard Registry Tampering Via CommandLine sigmaWindows Defender Context Menu Removed sigmaWindows EventLog Autologger Session Registry Modification Via CommandLine	13	42
`OriginalFileName`	`eq`	`auditpol.exe` sigmaAudit Policy Tampering Via Auditpol splunkWindows Audit Policy Auditing Option Disabled via Auditpol splunkWindows Audit Policy Cleared via Auditpol splunkWindows Audit Policy Disabled via Auditpol splunkWindows Audit Policy Disabled via Legacy Auditpol splunkWindows Audit Policy Excluded Category via Auditpol splunkWindows Audit Policy Restored via Auditpol splunkWindows Audit Policy Security Descriptor Tampering via Auditpol splunkWindows Global Object Access Audit List Cleared Via Auditpol	9	10
`OriginalFileName`	`eq`	`powershell_ise.exe` sigmaSuspicious Uninstall of Windows Defender Feature via PowerShell sigmaSuspicious Windows Service Tampering sigmaWindows Defender Context Menu Removed splunkPowershell Disable Security Monitoring splunkWindows Impair Defense Add Xml Applocker Rules	5	51
`sourcetype`	`eq`	`httpevent` splunkGitHub Enterprise Delete Branch Ruleset splunkGitHub Enterprise Disable 2FA Requirement splunkGitHub Enterprise Disable Audit Log Event Stream splunkGitHub Enterprise Disable Classic Branch Protection Rule splunkGitHub Enterprise Disable Dependabot splunkGitHub Enterprise Disable IP Allow List splunkGitHub Enterprise Modify Audit Log Event Stream splunkGitHub Enterprise Pause Audit Log Event Stream splunkGitHub Enterprise Register Self Hosted Runner	9	12
`sourcetype`	`eq`	`aws:cloudtrail` splunkAWS Bedrock Delete GuardRails splunkAWS Bedrock Delete Model Invocation Logging Configuration splunkAWS Defense Evasion Delete Cloudtrail splunkAWS Defense Evasion Delete CloudWatch Log Group splunkAWS Defense Evasion Impair Security Services splunkAWS Defense Evasion PutBucketLifecycle splunkAWS Defense Evasion Stop Logging Cloudtrail splunkAWS Defense Evasion Update Cloudtrail	8	59
`sourcetype`	`eq`	`aws:asl` splunkASL AWS Defense Evasion Delete Cloudtrail splunkASL AWS Defense Evasion Delete CloudWatch Log Group splunkASL AWS Defense Evasion Impair Security Services splunkASL AWS Defense Evasion PutBucketLifecycle splunkASL AWS Defense Evasion Stop Logging Cloudtrail splunkASL AWS Defense Evasion Update Cloudtrail	6	27
`process_name`	`eq`	`auditpol.exe` splunkWindows Audit Policy Auditing Option Disabled via Auditpol splunkWindows Audit Policy Cleared via Auditpol splunkWindows Audit Policy Disabled via Auditpol splunkWindows Audit Policy Disabled via Legacy Auditpol splunkWindows Audit Policy Excluded Category via Auditpol splunkWindows Audit Policy Restored via Auditpol splunkWindows Audit Policy Security Descriptor Tampering via Auditpol splunkWindows Global Object Access Audit List Cleared Via Auditpol	8	10
`CommandLine`	`contains`	`add` sigmaHypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine sigmaSuspicious Windows Defender Folder Exclusion Added Via Reg.EXE sigmaVulnerable Driver Blocklist Registry Tampering Via CommandLine sigmaWindows Credential Guard Registry Tampering Via CommandLine sigmaWindows EventLog Autologger Session Registry Modification Via CommandLine	5	12
`CommandLine`	`contains`	`delete` sigmaDisable Windows Defender AV Security Monitoring sigmaPotential Tampering With Security Products Via WMIC sigmaRaccine Uninstall splunkProcess Kill Base On File Path splunkWindows Raccine Scheduled Task Deletion	5	23
`CommandLine`	`contains`	`disable` sigmaAudit Policy Tampering Via Auditpol sigmaDisable Security Tools splunkDisabling Firewall with Netsh splunkPowershell Disable Security Monitoring splunkWindows Audit Policy Disabled via Auditpol	5	13
`CommandLine`	`contains`	`/set` splunkWindows Audit Policy Auditing Option Disabled via Auditpol splunkWindows Audit Policy Disabled via Auditpol splunkWindows Audit Policy Excluded Category via Auditpol splunkWindows Audit Policy Security Descriptor Tampering via Auditpol	4	6
`CommandLine`	`contains`	`add-mppreference` sigmaPowershell Base64 Encoded MpPreference Cmdlet sigmaPowershell Defender Disable Scan Feature sigmaPowershell Defender Exclusion splunkAdd or Set Windows Defender Exclusion	4	4
`CommandLine`	`contains`	`config` sigmaDisable Windows Defender AV Security Monitoring sigmaDisable Windows IIS HTTP Logging sigmaESXi Syslog Configuration Change Via ESXCLI sigmaSuspicious Windows Service Tampering	4	16
`CommandLine`	`contains`	`set-mppreference` sigmaPowershell Base64 Encoded MpPreference Cmdlet sigmaPowershell Defender Disable Scan Feature sigmaPowershell Defender Exclusion splunkAdd or Set Windows Defender Exclusion	4	4
`CommandLine`	`contains`	`si` sigmaHypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine sigmaVulnerable Driver Blocklist Registry Tampering Via CommandLine sigmaWindows Credential Guard Registry Tampering Via CommandLine sigmaWindows EventLog Autologger Session Registry Modification Via CommandLine	4	5
`EventID`	`eq`	`4104` splunkPowershell Remove Windows Defender Directory splunkPowershell Windows Defender Exclusion Commands splunkUnloading AMSI via Reflection splunkWindows PowerShell Disable HTTP Logging splunkWindows Powershell Import Applocker Policy	5	268
`aws::errorCode`	`eq`	`success` splunkAWS Defense Evasion Delete Cloudtrail splunkAWS Defense Evasion Delete CloudWatch Log Group splunkAWS Defense Evasion PutBucketLifecycle splunkAWS Defense Evasion Stop Logging Cloudtrail splunkAWS Defense Evasion Update Cloudtrail	5	12
`sourcetype`	`in`	`vmw-syslog` splunkESXi Download Errors splunkESXi Encryption Settings Modified splunkESXi Lockdown Mode Disabled splunkESXi Loghost Config Tampering splunkESXi VIB Acceptance Level Tampering	5	23
`sourcetype`	`in`	`vmware:esxlog*` splunkESXi Download Errors splunkESXi Encryption Settings Modified splunkESXi Lockdown Mode Disabled splunkESXi Loghost Config Tampering splunkESXi VIB Acceptance Level Tampering	5	23

Exclusions (185 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Field	Kind	Value	Rules excluding
`CommandLine`	`contains`	`/?` splunkWindows Audit Policy Excluded Category via Auditpol splunkWindows Audit Policy Restored via Auditpol splunkWindows Audit Policy Security Descriptor Tampering via Auditpol splunkWindows Global Object Access Audit List Cleared Via Auditpol	4
`Image`	`ends_with`	`\msmpeng.exe` sigmaDisable Tamper Protection on Windows Defender sigmaHackTool - SysmonEnte Execution sigmaPotential AutoLogger Sessions Tampering sigmaRemoval Of AMSI Provider Registry Keys	4
`Image`	`ends_with`	`\tiworker.exe` sigmaChange Winevt Channel Access Permission Via Registry sigmaDisable Windows Event Logging Via Registry	2
`Image`	`in`	`:\\windows\\system32\\` splunkWindows Cisco Secure Endpoint Stop Immunet Service Via Sfc splunkWindows Cisco Secure Endpoint Unblock File Via Sfc splunkWindows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc	3
`Image`	`in`	`:\\windows\\syswow64\\` splunkWindows Cisco Secure Endpoint Stop Immunet Service Via Sfc splunkWindows Cisco Secure Endpoint Unblock File Via Sfc splunkWindows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc	3
`Image`	`in`	`:\\windows\\winsxs\\*` splunkWindows Cisco Secure Endpoint Stop Immunet Service Via Sfc splunkWindows Cisco Secure Endpoint Unblock File Via Sfc splunkWindows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc	3
`Image`	`starts_with`	`c:\programdata\microsoft\windows defender\platform\` sigmaDisable Tamper Protection on Windows Defender sigmaPotential AutoLogger Sessions Tampering sigmaRemoval Of AMSI Provider Registry Keys	3
`Image`	`starts_with`	`c:\program files (x86)\windows defender\` sigmaPotential AutoLogger Sessions Tampering sigmaRemoval Of AMSI Provider Registry Keys	2
`Image`	`starts_with`	`c:\program files\windows defender\` sigmaPotential AutoLogger Sessions Tampering sigmaRemoval Of AMSI Provider Registry Keys	2
`Image`	`starts_with`	`c:\windows\winsxs\` sigmaChange Winevt Channel Access Permission Via Registry sigmaDisable Windows Event Logging Via Registry	2
`CommandLine`	`in`	`/?` splunkWindows Audit Policy Cleared via Auditpol splunkWindows Audit Policy Disabled via Auditpol	2
`Image`	`eq`	`c:\windows\servicing\trustedinstaller.exe` sigmaChange Winevt Channel Access Permission Via Registry sigmaDisable Windows Event Logging Via Registry	2
`Image`	`eq`	`c:\windows\system32\svchost.exe` sigmaDisable Windows Event Logging Via Registry sigmaWFP Filter Added via Registry	2
`Image`	`eq`	`c:\windows\system32\wevtutil.exe` sigmaDisable Windows Event Logging Via Registry sigmaPotential AutoLogger Sessions Tampering	2
`CallTrace`	`contains`	`microsoft.build.ni.dll` sigmaSuspicious Svchost Process Access	1

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Disable or Modify Tools `T1685`

Events covered

Authoring guide

Fields filtered most (106 distinct)

Top indicator values (2010 distinct)

Exclusions (185 distinct)

Rules under this technique

Sigma 200 rules

Splunk 159 rules

Keyboard shortcuts

Search operators

Disable or Modify Tools T1685

Events covered

Authoring guide

Fields filtered most (106 distinct)

Top indicator values (2010 distinct)

Exclusions (185 distinct)

Rules under this technique

Sigma 200 rules

Splunk 159 rules

Disable or Modify Tools `T1685`