Disable or Modify Tools `T1685`

Tactic: Defense Impairment

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.

Events covered

76 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 3	Network connection
Sysmon	Event ID 5	Process terminated
Sysmon	Event ID 7	Image loaded
Sysmon	Event ID 10	ProcessAccess
Sysmon	Event ID 11	FileCreate
Sysmon	Event ID 12	RegistryEvent (Object create and delete)
Sysmon	Event ID 13	RegistryEvent (Value Set)
Sysmon	Event ID 14	RegistryEvent (Key and Value Rename)
Sysmon	Event ID 17	PipeEvent (Pipe Created)
Sysmon	Event ID 18	PipeEvent (Pipe Connected)
Security-Auditing	Event ID 4624	An account was successfully logged on.
Security-Auditing	Event ID 4656	A handle to an object was requested.
Security-Auditing	Event ID 4657	A registry value was modified.
Security-Auditing	Event ID 4663	An attempt was made to access an object.
Security-Auditing	Event ID 4670	Permissions on an object were changed.
Security-Auditing	Event ID 4673	A privileged service was called.
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4689	A process has exited.
Security-Auditing	Event ID 4719	System audit policy was changed.
Security-Auditing	Event ID 4720	A user account was created.
Security-Auditing	Event ID 4738	A user account was changed.
Security-Auditing	Event ID 4950	A Windows Firewall setting has changed.
Security-Auditing	Event ID 5123	A configuration entry changed in the OCSP Responder Service.
Security-Auditing	Event ID 5136	A directory service object was modified.
Security-Auditing	Event ID 5152	The Windows Filtering Platform blocked a packet.
Security-Auditing	Event ID 5157	The Windows Filtering Platform has blocked a connection.
Security-Auditing	Event ID 5441	The following filter was present when the Windows Filtering Platform Base Filtering Engine started.
Security-Auditing	Event ID 5447	A Windows Filtering Platform filter has been changed.
Security-Auditing	Event ID 5448	A Windows Filtering Platform provider has been changed.
1Password-Account	account-updatfw	Update Firewall Rules
Application-Error	Event ID 1000	Faulting application name: Faulting_application_name, version: version, time stamp: 0xFaulting_module_name.
Application-Popup	Event ID 26	Application popup: Caption : Message.
Defender-DeviceProcessEvents	any	Process activity
Defender-DeviceRegistryEvents	any	Registry activity
Defender-DeviceRegistryEvents	RegistryKeyDeleted	Registry key deleted
Defender-DeviceRegistryEvents	RegistryValueSet	Registry value set
Defender-DeviceRegistryEvents	RegistryValueDeleted	Registry value deleted
Defender-DeviceRegistryEvents	RegistryKeyRenamed	Registry key renamed
ESF	exec	Process Execution
ESF	signal	Signal Delivery
Linux-Auditd	Event ID 1131	SERVICE_STOP
Linux-Auditd	Event ID 1200	DAEMON_START
Linux-Auditd	Event ID 1201	DAEMON_END
Linux-Auditd	Event ID 1202	DAEMON_ABORT
Linux-Auditd	Event ID 1300	SYSCALL
Linux-Auditd	Event ID 1302	PATH
Linux-Auditd	Event ID 1309	EXECVE
MSSQLSERVER	Event ID 33205	Event ID 33205
Eventlog	Event ID 104	The LogFileCleared.Channel log file was cleared.
Eventlog	Event ID 1100	The event logging service has shut down.
Eventlog	Event ID 1102	The audit log was cleared.
IIS-Configuration	Event ID 29	Changes to 'Configuration' at 'ConfigPath' have successfully been committed.
PowerShell	Event ID 4103	Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).
SMBClient	Event ID 31018	Guidance: An administrator has enabled AllowInsecureGuestAuth.
WMI-Activity	Event ID 5858	Id = Operation_ClientFailure.Id; ClientMachine = Operation_ClientFailure.ClientMachine; User = Operation_ClientFailure.User; ClientProcessId = Operation_ClientFailure.ClientProcessId; Component = Operation_ClientFailure.Component; Operation = Operation_ClientFailure.Operation; ResultCode = Operation_ClientFailure.ResultCode; PossibleCause = Operation_ClientFailure.PossibleCause.
Windows-Defender	Event ID 1009	ProductName has restored an item from quarantine.
Windows-Defender	Event ID 1119	ProductName has encountered a critical error when taking action on malware or other potentially unwanted software.
Windows-Defender	Event ID 3002	ProductName Real-Time Protection feature has encountered an error and failed.
Windows-Defender	Event ID 3007	ProductName Real-time Protection feature has restarted.
Windows-Defender	Event ID 5001	Product Name Real-time Protection scanning for malware and other potentially unwanted software was disabled.
Windows-Defender	Event ID 5007	Product Name Configuration has changed.
Windows-Defender	Event ID 5010	ProductName scanning for spyware and other potentially unwanted software is disabled.
Windows-Defender	Event ID 5012	ProductName scanning for viruses is disabled.
Windows-Defender	Event ID 5013	Tamper Protection Changed Type a change to Product Name.
Windows-Defender	Event ID 5101	{Product Name} grace period has expired.
Windows-Firewall-With-Advanced-Security	Event ID 2003	A Windows Defender Firewall setting in the Profiles profile has changed.
Windows-Firewall-With-Advanced-Security	Event ID 2004	A rule has been added to the Windows Defender Firewall exception list.
Windows-Firewall-With-Advanced-Security	Event ID 2005	A rule has been modified in the Windows Defender Firewall exception list.
PowerShell	Event ID 600	Event ID 600
PowerShell	Event ID 800	Event ID 800
Service-Control-Manager	Event ID 7036	The Microsoft Software Shadow Copy Provider service entered the stopped state.
Service-Control-Manager	Event ID 7040	The start type of the msdsm service was changed from boot start to demand start.
Sysmon-for-Linux	Event ID 1	Process Create
Windows-Error-Reporting	Event ID 1001	Fault bucket , type.

Authoring guide

These 916 rules share fields, values, and exclusions.

Fields filtered most (441 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	153	`eq` 99, `in` 41, `wildcard` 11, `ne` 5, `ends_with` 3	`exec`, `ProcessRollup2`, `exec_event`, `start`, `deleted`
`CommandLine`	139	`contains` 123, `in` 15, `regex_match` 5, `ends_with` 4, `match` 3, `wildcard` 3, `starts_with` 1	`disabled`, `add` , `config`, `add` , `delete`
`Details`	123	`eq` 89, `is_not_null` 26, `contains` 17, `in` 11, `wildcard` 4, `ends_with` 1	`0x00000000`, `0x00000001`, `dword (0x00000000)`, `0`, `1`
`Image`	103	`ends_with` 72, `eq` 12, `is_not_null` 12, `starts_with` 11, `contains` 6, `wildcard` 3, `regex_match` 2, `is_null` 1	`\powershell.exe`, `\pwsh.exe`, `\reg.exe`, `\powershell_ise.exe`, `\msmpeng.exe`
`process_name`	102	`eq` 82, `in` 14, `starts_with` 6, `regex_match` 4, `ends_with` 2, `is_not_null` 2, `wildcard` 1	`powershell.exe`, `auditpol.exe`, `chkconfig`, `killall`, `powershell_ise.exe`
`data_stream.dataset`	87	`eq` 87	`aws.cloudtrail`, `o365.audit`, `gcp.audit`, `okta.system`, `azure.activitylogs`
`EventID`	74	`eq` 69, `in` 3, `regex_match` 3	`4104`, `4688`, `1`, `4103`, `4656`
`event.type`	72	`eq` 66, `in` 5, `ne` 1	`start`, `change`, `deletion`, `process_started`, `creation`
`TargetObject`	70	`ends_with` 30, `contains` 28, `wildcard` 14, `eq` 7, `starts_with` 2, `is_not_null` 1	`\software\microsoft\windows...`, `\control\keyboard layouts\`, `\deviceguard\enablevirtualizationbasedsecurity`, `\deviceguard\lsacfgflags`, `\microsoft\windows\currentversion\winevt\channels\`
`event.outcome`	66	`eq` 65, `in` 1	`success`, `failure`
`aws::eventName`	64	`eq` 45, `in` 22, `ne` 2	`deletetrail`, `stoplogging`, `updatetrail`, `PutBucketVersioning`, `deletedetector`
`OriginalFileName`	61	`eq` 58, `in` 5	`powershell.exe`, `pwsh.dll`, `reg.exe`, `auditpol.exe`, `powershell_ise.exe`
`Provider_Name`	59	`eq` 55, `in` 4	`exchange`, `ec2.amazonaws.com`, `cloudtrail.amazonaws.com`, `bedrock.amazonaws.com`, `guardduty.amazonaws.com`
`host.os.type`	58	`eq` 57, `in` 1
`registry_path`	56	`ends_with` 34, `contains` 20, `in` 3	`\\microsoft\\windows defender\\spynet`, `\\policies\\microsoft\\windows defender`, `\\microsoft\\windows\\currentversion\\winevt\\channels\\`, `\\microsoft\\windows\\system\\enablesmartscreen`, `\\software\\microsoft\\windows\\currentversion\\explorer...`

Top indicator values (4438 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.outcome`	`eq`	`success` elasticAWS Backup Vault Deleted or Vault Lock Removed elasticAWS Bedrock Automated Reasoning Safety Policy Tampering elasticAWS Bedrock Guardrail Deleted or Weakened elasticAWS Bedrock Model Invocation Logging Disabled or Modified elasticAWS CloudTrail Log Created elasticAWS CloudTrail Log Deleted elasticAWS CloudTrail Log Evasion elasticAWS CloudTrail Log Suspended elasticAWS CloudTrail Log Updated elasticAWS CloudTrail Management Events Disabled via PutEventSelectors elasticAWS CloudWatch Alarm Deletion elasticAWS CloudWatch Log Group Deletion elasticAWS CloudWatch Log Stream Deletion elasticAWS Config Resource Deletion elasticAWS Configuration Recorder Stopped +50 more rules	65	369
`event.type`	`eq`	`start` elasticAppArmor Profile Compilation via apparmor_parser elasticAttempt to Clear Kernel Ring Buffer elasticAttempt to Clear Kernel Ring Buffer via Dmesg elasticAttempt to Clear Logs via Journalctl elasticAttempt to Clear Logs via Journalctl elasticAttempt to Disable Auditd Service elasticAttempt to Disable Auditd Service elasticAttempt to Disable IPTables or Firewall elasticAttempt to Disable SELinux elasticAttempt to Disable Syslog Service elasticAuditctl Disabled via Shell Process elasticBPF filter applied using TC elasticBPF Filter Applied using Traffic Control elasticBPF Program Tampering via bpftool elasticClearing Windows Event Logs +34 more rules	49	1078
`event.type`	`eq`	`change` elasticAppArmor Policy Violation Detected elasticDisabling Lsa Protection via Registry Modification elasticDisabling User Account Control via Registry Modification elasticDNS Global Query Block List Modified or Disabled elasticDNS-over-HTTPS Enabled via Registry elasticGitHub Protected Branch Settings Changed elasticGitHub Secret Scanning Disabled elasticLocal Account TokenFilter Policy Disabled elasticMicrosoft Windows Defender Tampering elasticPowerShell Script Block Logging Disabled elasticScheduled Tasks AT Command Enabled elasticService Disabled via Registry Modification elasticSolarWinds Process Disabling Services via Registry elasticWindows Defender Disabled via Registry Modification	14	94
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS Attempt to Leave Organization elasticAWS Backup Vault Deleted or Vault Lock Removed elasticAWS Bedrock Automated Reasoning Safety Policy Tampering elasticAWS Bedrock Guardrail Deleted or Weakened elasticAWS Bedrock Model Invocation Logging Disabled or Modified elasticAWS CloudTrail Log Created elasticAWS CloudTrail Log Deleted elasticAWS CloudTrail Log Evasion elasticAWS CloudTrail Log Suspended elasticAWS CloudTrail Log Updated elasticAWS CloudTrail Management Events Disabled via PutEventSelectors elasticAWS CloudWatch Alarm Deletion elasticAWS CloudWatch Log Group Deletion elasticAWS CloudWatch Log Stream Deletion elasticAWS Config Resource Deletion +22 more rules	37	169
`data_stream.dataset`	`eq`	`o365.audit` elasticDeprecated - M365 Exchange DLP Policy Deleted elasticDeprecated - M365 Teams External Access Enabled elasticM365 Exchange Anti-Phish Policy Deleted elasticM365 Exchange Anti-Phish Rule Modification elasticM365 Exchange DKIM Signing Configuration Disabled elasticM365 Exchange Email Safe Attachment Rule Disabled elasticM365 Exchange Email Safe Link Policy Disabled elasticM365 Exchange Mail Flow Transport Rule Modified elasticM365 Exchange Mailbox Audit Logging Bypass Added elasticM365 Exchange Malware Filter Policy Deleted elasticM365 Exchange Malware Filter Rule Modified elasticM365 SharePoint Site Sharing Policy Weakened elasticM365 Teams Custom Application Interaction Enabled	13	47
`data_stream.dataset`	`eq`	`gcp.audit` elasticGCP Firewall Rule Creation elasticGCP Firewall Rule Deletion elasticGCP Firewall Rule Modification elasticGCP Logging Bucket Deletion elasticGCP Logging Sink Deletion elasticGCP Logging Sink Modification elasticGCP Pub/Sub Subscription Deletion elasticGCP Pub/Sub Topic Deletion elasticGCP Virtual Private Cloud Network Deletion elasticGCP Virtual Private Cloud Route Creation elasticGCP Virtual Private Cloud Route Deletion elasticGKE Admission Webhook Created or Modified	12	69
`Details`	`eq`	`0x00000000` elasticDisabling User Account Control via Registry Modification elasticDNS Global Query Block List Modified or Disabled elasticMicrosoft Windows Defender Tampering elasticModification of AmsiEnable Registry Key elasticNetwork-Level Authentication (NLA) Disabled elasticPowerShell Script Block Logging Disabled splunkDisable AMSI Through Registry splunkDisable Defender MpEngine Registry splunkDisable Defender Spynet Reporting splunkDisable ETW Through Registry splunkDisable Show Hidden Files splunkETW Registry Disabled splunkHide User Account From Sign-In Screen splunkWindows Impair Defense Configure App Install Control splunkWindows Impair Defense Disable Controlled Folder Access +10 more rules	25	41
`Details`	`eq`	`0x00000001` elasticDNS-over-HTTPS Enabled via Registry elasticLocal Account TokenFilter Policy Disabled elasticMicrosoft Windows Defender Tampering elasticScheduled Tasks AT Command Enabled elasticWindows Defender Disabled via Registry Modification splunkDisable Defender BlockAtFirstSeen Feature splunkDisable Defender Enhanced Notification splunkDisable Registry Tool splunkDisable Show Hidden Files splunkDisabling CMD Application splunkDisabling ControlPanel splunkDisabling FolderOptions Windows Feature splunkDisabling NoRun Windows App splunkDisabling Task Manager splunkWindows DisableAntiSpyware Registry +8 more rules	23	61
`Details`	`eq`	`dword (0x00000000)` sigmaAMSI Disabled via Registry Modification sigmaAntivirus Filter Driver Disallowed On Dev Drive - Registry sigmaDisable Privacy Settings Experience in Registry sigmaDisable PUA Protection on Windows Defender sigmaDisable Tamper Protection on Windows Defender sigmaDisable Windows Defender Functionalities Via Registry Keys sigmaDisable Windows Event Logging Via Registry sigmaDisabled Windows Defender Eventlog sigmaETW Logging Disabled For rpcrt4.dll sigmaETW Logging Disabled In .NET Processes - Sysmon Registry sigmaHide Schedule Task Via Index Value Tamper sigmaMicrosoft Office Protected View Disabled sigmaNetNTLM Downgrade Attack - Registry sigmaPotential AutoLogger Sessions Tampering sigmaTamper With Sophos AV Registry Keys +3 more rules	18	38
`Details`	`eq`	`0` sigmaETW Logging Disabled In .NET Processes - Registry sigmaETW Logging Disabled In .NET Processes - Sysmon Registry elasticDefense Evasion via Registry Modification elasticDisabling User Account Control via Registry Modification elasticDNS Global Query Block List Modified or Disabled elasticMicrosoft Windows Defender Tampering elasticModification of AmsiEnable Registry Key elasticNetwork-Level Authentication (NLA) Disabled elasticPowerShell Script Block Logging Disabled elasticUser Account Control Disabled via Registry elasticWindows Defender Exclusions by Extension	11	18
`EventType`	`eq`	`exec` elasticAttempt to Clear Kernel Ring Buffer via Dmesg elasticAttempt to Clear Logs via Journalctl elasticAttempt to Disable Auditd Service elasticAttempt to Disable SELinux elasticAuditctl Disabled via Shell Process elasticBPF Filter Applied using Traffic Control elasticGitHub Actions Runner with Disabled Telemetry elasticKill Command Executed from Binary in Unusual Location elasticKill Command Execution elasticKillall Execution via Python elasticLoadable Kernel Module Load Followed by Log Clearing elasticNotificationCenter Silenced via Killall Binary elasticPotential Disabling of AppArmor elasticSuspicious Access to AppArmor Policy Management Files elasticSuspicious Crypto Wallet Process Termination +2 more rules	17	576
`security_result.action`	`eq`	`ALLOW` chronicleAWS CloudTrail Logging Tampered chronicleAWS Config Service Modified chronicleAWS Delete CloudWatch Log Group chronicleAWS Delete VPC Flow Logs chronicleAWS GuardDuty Disabled chronicleAWS GuardDuty Publishing Destination Deleted chronicleAWS GuardDuty Trusted Or Threat IP Lists Tampered chronicleAWS IAM Access Analyzer Deleted chronicleAWS S3 Bucket Made Public By ACL chronicleAWS S3 Public Access Block Removed chronicleAWS Security Group Open To The World chronicleGCP BigQuery Datasets Opened To Public chronicleGCP Cloud Audit Logging Removed From All Services chronicleGCP Exempt Principals From Audit Log chronicleGCP Firewall Rule Opened To The World +2 more rules	17	102
`EventType`	`in`	`exec` elasticAppArmor Profile Compilation via apparmor_parser elasticAttempt to Clear Kernel Ring Buffer elasticAttempt to Clear Logs via Journalctl elasticAttempt to Disable Auditd Service elasticAttempt to Disable IPTables or Firewall elasticAttempt to Disable Syslog Service elasticBPF filter applied using TC elasticBPF Program Tampering via bpftool elasticGenAI CLI Started with Unsafe Permission Bypass elasticKernel Module Removal elasticPotential Disabling of AppArmor elasticPotential Disabling of SELinux elasticSuspicious Kernel Feature Activity elasticSuspicious Write Attempt to AppArmor Policy Management Files	14	201
`EventType`	`in`	`start` elasticAppArmor Profile Compilation via apparmor_parser elasticAttempt to Clear Kernel Ring Buffer elasticAttempt to Clear Logs via Journalctl elasticAttempt to Disable Auditd Service elasticAttempt to Disable IPTables or Firewall elasticAttempt to Disable Syslog Service elasticBPF filter applied using TC elasticBPF Program Tampering via bpftool elasticGenAI CLI Started with Unsafe Permission Bypass elasticKernel Module Removal elasticPotential Disabling of AppArmor elasticPotential Disabling of SELinux elasticSuspicious Write Attempt to AppArmor Policy Management Files	13	163
`EventType`	`in`	`ProcessRollup2` elasticAppArmor Profile Compilation via apparmor_parser elasticAttempt to Clear Kernel Ring Buffer elasticAttempt to Clear Logs via Journalctl elasticAttempt to Disable Auditd Service elasticAttempt to Disable Syslog Service elasticBPF filter applied using TC elasticBPF Program Tampering via bpftool elasticKernel Module Removal elasticPotential Disabling of AppArmor elasticPotential Disabling of SELinux elasticSuspicious Kernel Feature Activity elasticSuspicious Write Attempt to AppArmor Policy Management Files	12	117
`EventType`	`in`	`exec_event` elasticAppArmor Profile Compilation via apparmor_parser elasticAttempt to Clear Kernel Ring Buffer elasticAttempt to Clear Logs via Journalctl elasticAttempt to Disable Auditd Service elasticAttempt to Disable IPTables or Firewall elasticAttempt to Disable Syslog Service elasticBPF filter applied using TC elasticBPF Program Tampering via bpftool elasticKernel Module Removal elasticPotential Disabling of AppArmor elasticPotential Disabling of SELinux elasticSuspicious Write Attempt to AppArmor Policy Management Files	12	149
`Image`	`ends_with`	`\powershell.exe` sigmaDisable Windows Defender AV Security Monitoring sigmaHypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine sigmaObfuscated PowerShell OneLiner Execution sigmaSecurity Event Logging Disabled via MiniNt Registry Key - Process sigmaService StartupType Change Via PowerShell Set-Service sigmaSuspicious Eventlog Clearing or Configuration Change Activity sigmaSuspicious Uninstall of Windows Defender Feature via PowerShell sigmaSuspicious Windows Service Tampering sigmaVulnerable Driver Blocklist Registry Tampering Via CommandLine sigmaWindows AMSI Related Registry Tampering Via CommandLine sigmaWindows Credential Guard Registry Tampering Via CommandLine sigmaWindows Defender Context Menu Removed sigmaWindows EventLog Autologger Session Registry Modification Via CommandLine sigmaWindows Firewall Disabled via PowerShell	14	179
`Image`	`ends_with`	`\reg.exe` sigmaAdd SafeBoot Keys Via Reg Utility sigmaDisabling Windows Defender WMI Autologger Session via Reg.exe sigmaHypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine sigmaReg Add Suspicious Paths sigmaSecurity Event Logging Disabled via MiniNt Registry Key - Process sigmaSuspicious Windows Defender Folder Exclusion Added Via Reg.EXE sigmaSuspicious Windows Defender Registry Key Tampering Via Reg.EXE sigmaVulnerable Driver Blocklist Registry Tampering Via CommandLine sigmaWdigest authentication enabled (Reg via command) sigmaWindows AMSI Related Registry Tampering Via CommandLine sigmaWindows Credential Guard Registry Tampering Via CommandLine sigmaWindows Defender Context Menu Removed sigmaWindows EventLog Autologger Session Registry Modification Via CommandLine	13	58
`Image`	`ends_with`	`\pwsh.exe` sigmaDisable Windows Defender AV Security Monitoring sigmaHypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine sigmaSecurity Event Logging Disabled via MiniNt Registry Key - Process sigmaSuspicious Eventlog Clearing or Configuration Change Activity sigmaSuspicious Uninstall of Windows Defender Feature via PowerShell sigmaSuspicious Windows Service Tampering sigmaVulnerable Driver Blocklist Registry Tampering Via CommandLine sigmaWindows AMSI Related Registry Tampering Via CommandLine sigmaWindows Credential Guard Registry Tampering Via CommandLine sigmaWindows Defender Context Menu Removed sigmaWindows EventLog Autologger Session Registry Modification Via CommandLine sigmaWindows Firewall Disabled via PowerShell	12	165
`OriginalFileName`	`eq`	`powershell.exe` sigmaDisable Windows Defender AV Security Monitoring sigmaHypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine sigmaSecurity Event Logging Disabled via MiniNt Registry Key - Process sigmaService StartupType Change Via PowerShell Set-Service sigmaSuspicious Uninstall of Windows Defender Feature via PowerShell sigmaSuspicious Windows Service Tampering sigmaVulnerable Driver Blocklist Registry Tampering Via CommandLine sigmaWindows AMSI Related Registry Tampering Via CommandLine sigmaWindows Credential Guard Registry Tampering Via CommandLine sigmaWindows Defender Context Menu Removed sigmaWindows EventLog Autologger Session Registry Modification Via CommandLine sigmaWindows Firewall Disabled via PowerShell splunkPowershell Disable Security Monitoring splunkWindows Impair Defense Add Xml Applocker Rules	14	138
`OriginalFileName`	`eq`	`pwsh.dll` sigmaDisable Windows Defender AV Security Monitoring sigmaHypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine sigmaSecurity Event Logging Disabled via MiniNt Registry Key - Process sigmaSuspicious Uninstall of Windows Defender Feature via PowerShell sigmaSuspicious Windows Service Tampering sigmaVulnerable Driver Blocklist Registry Tampering Via CommandLine sigmaWindows AMSI Related Registry Tampering Via CommandLine sigmaWindows Credential Guard Registry Tampering Via CommandLine sigmaWindows Defender Context Menu Removed sigmaWindows EventLog Autologger Session Registry Modification Via CommandLine sigmaWindows Firewall Disabled via PowerShell splunkPowershell Disable Security Monitoring splunkWindows Impair Defense Add Xml Applocker Rules	13	112
`OriginalFileName`	`eq`	`reg.exe` sigmaAdd SafeBoot Keys Via Reg Utility sigmaDisabling Windows Defender WMI Autologger Session via Reg.exe sigmaHypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine sigmaReg Add Suspicious Paths sigmaSafeBoot Registry Key Deleted Via Reg.EXE sigmaSecurity Event Logging Disabled via MiniNt Registry Key - Process sigmaService Registry Key Deleted Via Reg.EXE sigmaSuspicious Windows Defender Registry Key Tampering Via Reg.EXE sigmaVulnerable Driver Blocklist Registry Tampering Via CommandLine sigmaWindows AMSI Related Registry Tampering Via CommandLine sigmaWindows Credential Guard Registry Tampering Via CommandLine sigmaWindows Defender Context Menu Removed sigmaWindows EventLog Autologger Session Registry Modification Via CommandLine	13	43
`OriginalFileName`	`eq`	`auditpol.exe` sigmaAudit Policy Tampering Via Auditpol elasticDisable Windows Event and Security Logs Using Built-in Tools splunkWindows Audit Policy Auditing Option Disabled via Auditpol splunkWindows Audit Policy Cleared via Auditpol splunkWindows Audit Policy Disabled via Auditpol splunkWindows Audit Policy Disabled via Legacy Auditpol splunkWindows Audit Policy Excluded Category via Auditpol splunkWindows Audit Policy Restored via Auditpol splunkWindows Audit Policy Security Descriptor Tampering via Auditpol splunkWindows Global Object Access Audit List Cleared Via Auditpol	10	10
`data.type`	`eq`	`sapi` sigmaAttack protection features manipulation - some attack protection features have been disabled. sigmaBot detection - the feature is turned off completely or some policies. sigmaBreached Password Detection - critical settings manipulated sigmaBrute Force Protection - critical settings manipulated sigmaInsecure OAuth2.x flows have been enabled for some applications sigmaLoaded LiquidJS error page template contains XSS vulnerabilities sigmaMFA downgrade - adaptive MFA risk assessment disabled sigmaMFA downgrade - disable MFA policies by modifying the policies sigmaMFA downgrade - disable strong factors sigmaSuspicious IP Throttling - critical settings manipulated sigmaUnauthorized or Unexpected Enabling of Cross-Origin Authentication (CORS) sigmaUnrecognized IP in attack protection allowlists pantherAuth0 Attack Protection Monitoring Disabled pantherAuth0 Bot Detection Policy Disabled	14	18
`process_name`	`eq`	`powershell.exe` elasticAMSI Bypass via PowerShell elasticClearing Windows Event Logs elasticDefense Evasion via Registry Modification elasticDisable Windows Event and Security Logs Using Built-in Tools elasticDisabling Windows Defender Security Settings via PowerShell elasticElastic Agent Service Terminated elasticSuspicious Windows Defender Exclusions Added via PowerShell elasticSuspicious Windows Defender Registry Modification elasticWindows Defender Exclusions Added via PowerShell elasticWindows Defender Exclusions by Extension elasticWindows Firewall Disabled via PowerShell splunkPowershell Disable Security Monitoring splunkWindows Impair Defense Add Xml Applocker Rules	13	184
`EventID`	`eq`	`4104` splunkETW Trace Provider Modified - PowerShell (PowerShell) splunkModify Windows Defender (PowerShell) splunkPowershell Remove Windows Defender Directory splunkPowershell Windows Defender Exclusion Commands splunkUnloading AMSI via Reflection splunkWindows - Service Stop (PowerShell) splunkWindows Defender Disabled Detection (PowerShell) splunkWindows Firewall Disabled (PowerShell) splunkWindows Firewall Rule Creation (PowerShell) splunkWindows PowerShell Disable HTTP Logging splunkWindows Powershell Import Applocker Policy	11	269
`event.category`	`eq`	`web` elasticDeprecated - M365 Exchange DLP Policy Deleted elasticDeprecated - M365 Teams External Access Enabled elasticM365 Exchange Anti-Phish Policy Deleted elasticM365 Exchange Anti-Phish Rule Modification elasticM365 Exchange DKIM Signing Configuration Disabled elasticM365 Exchange Email Safe Attachment Rule Disabled elasticM365 Exchange Email Safe Link Policy Disabled elasticM365 Exchange Mail Flow Transport Rule Modified elasticM365 Exchange Malware Filter Policy Deleted elasticM365 Exchange Malware Filter Rule Modified elasticM365 Teams Custom Application Interaction Enabled	11	20
`Provider_Name`	`eq`	`exchange` elasticDeprecated - M365 Exchange DLP Policy Deleted elasticM365 Exchange Anti-Phish Policy Deleted elasticM365 Exchange Anti-Phish Rule Modification elasticM365 Exchange DKIM Signing Configuration Disabled elasticM365 Exchange Email Safe Attachment Rule Disabled elasticM365 Exchange Email Safe Link Policy Disabled elasticM365 Exchange Mail Flow Transport Rule Modified elasticM365 Exchange Mailbox Audit Logging Bypass Added elasticM365 Exchange Malware Filter Policy Deleted elasticM365 Exchange Malware Filter Rule Modified	10	17
`aws::eventSource`	`eq`	`cloudtrail.amazonaws.com` sigmaAttempt To Delete A CloudTrail Log sigmaAttempt To Modify CloudTrail Log Settings sigmaAttempt To Stop CloudTrail Logging sigmaAWS CloudTrail Important Change sigmaCloudTrail Log Deleted sigmaCloudTrail Log Settings Modified sigmaCloudTrail Logging Stopped splunkAWS Defense Evasion Delete Cloudtrail splunkAWS Defense Evasion Stop Logging Cloudtrail splunkAWS Defense Evasion Update Cloudtrail	10	10
`resultType`	`in`	`Succeeded` pantherAzure Action Groups Deleted pantherAzure Alert Rules Deleted pantherAzure Alert Suppression Rule Created or Modified pantherAzure Diagnostic Settings Deleted pantherAzure Event Hub Deleted pantherAzure Log Analytics Workspace Deleted pantherAzure Network Watcher Deleted pantherAzure Recovery Services Protection Container Deleted pantherAzure Resource Lock Deleted pantherAzure Storage Immutability Policy Deleted	10	51

Exclusions (970 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`process.code_signature.trusted`	`eq`	`true` elasticAMSI or WLDP Bypass via Memory Patching elasticDefense Evasion via Registry Modification elasticFirewall Policy Changed by a Suspicious Process elasticProcess Creation with Unusual Mitigation elasticProcess Explorer Device Access by Unusual Process elasticUnusual Windows System Service Disabled elasticWindows Defender Exclusions by Path elasticWindows Defender Exclusions via WMI elasticWindows Firewall Exception List Modified via Untrusted Process	9
`Image`	`eq`	`c:\windows\system32\svchost.exe` sigmaDisable Windows Event Logging Via Registry sigmaWFP Filter Added via Registry elasticPotential CVE-2024-21338 Exploitation elasticPotential RemoteMonologue Attack elasticProcess Explorer Device Access by Unusual Process elasticWindows Defender Exclusions via WMI	6
`process.thread.Ext.call_stack_final_user_module.name`	`in`	`Unknown` elasticAMSI Bypass from Suspicious Module elasticAMSI or WLDP Bypass via Memory Patching elasticPotential AMSI Bypass via SetThreadContext elasticPotential ETW Bypass via VirtualProtect elasticPotential LogonUser API Hooking elasticProcess Explorer Device Access by Unusual Process	6
`process.thread.Ext.call_stack_final_user_module.name`	`in`	`Undetermined` elasticAMSI Bypass from Suspicious Module elasticPotential AMSI Bypass via SetThreadContext elasticPotential ETW Bypass via VirtualProtect elasticPotential LogonUser API Hooking elasticProcess Explorer Device Access by Unusual Process	5
`user.id`	`eq`	`s-1-5-18` elasticDefense Evasion via Registry Modification elasticPotential RemoteMonologue Attack elasticPowerShell Script with Windows Defender Tampering Capabilities elasticService Disabled via Registry Modification elasticUser Account Control Disabled via Registry elasticWindows Defender Disabled via Registry Modification	6
`CommandLine`	`contains`	`/?` splunkWindows Audit Policy Excluded Category via Auditpol splunkWindows Audit Policy Restored via Auditpol splunkWindows Audit Policy Security Descriptor Tampering via Auditpol splunkWindows Global Object Access Audit List Cleared Via Auditpol	4
`aws::userIdentity.type`	`eq`	`awsservice` elasticAWS Backup Vault Deleted or Vault Lock Removed elasticAWS EC2 NACL Entry Created or Replaced Allowing All Traffic by New Identity elasticAWS IAM Permission Boundary or Guardrail Policy Deleted by Unusual Identity elasticAWS KMS Key Policy Updated via PutKeyPolicy	4
`Image`	`ends_with`	`\msmpeng.exe` sigmaDisable Tamper Protection on Windows Defender sigmaPotential AutoLogger Sessions Tampering sigmaRemoval Of AMSI Provider Registry Keys	3
`Image`	`in`	`:\\windows\\system32\\` splunkWindows Cisco Secure Endpoint Stop Immunet Service Via Sfc splunkWindows Cisco Secure Endpoint Unblock File Via Sfc splunkWindows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc	3
`Image`	`in`	`:\\windows\\syswow64\\` splunkWindows Cisco Secure Endpoint Stop Immunet Service Via Sfc splunkWindows Cisco Secure Endpoint Unblock File Via Sfc splunkWindows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc	3
`Image`	`in`	`:\\windows\\winsxs\\*` splunkWindows Cisco Secure Endpoint Stop Immunet Service Via Sfc splunkWindows Cisco Secure Endpoint Unblock File Via Sfc splunkWindows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc	3
`Image`	`starts_with`	`c:\programdata\microsoft\windows defender\platform\` sigmaDisable Tamper Protection on Windows Defender sigmaPotential AutoLogger Sessions Tampering sigmaRemoval Of AMSI Provider Registry Keys	3
`Image`	`starts_with`	`c:\windows\winsxs\` sigmaChange Winevt Channel Access Permission Via Registry sigmaDisable Windows Event Logging Via Registry sigmaLoad Of RstrtMgr.DLL By An Uncommon Process	3
`aws::errorCode`	`eq`	`accessdenied` sigmaCloudTrail Log Deleted sigmaCloudTrail Log Settings Modified sigmaCloudTrail Logging Stopped	3
`aws::userAgent`	`eq`	`aws internal` elasticAWS CloudWatch Alarm Deletion elasticAWS CloudWatch Log Group Deletion elasticAWS CloudWatch Log Stream Deletion	3

Disable or Modify Tools `T1685`

Events covered

Authoring guide

Fields filtered most (441 distinct)

Top indicator values (4438 distinct)

Exclusions (970 distinct)

Rules under this technique

Sigma 262 rules

Elastic 217 rules

Splunk 188 rules

Kusto 113 rules

YARA-L 37 rules

Panther 99 rules

Disable or Modify Tools T1685

Events covered

Authoring guide

Fields filtered most (441 distinct)

Top indicator values (4438 distinct)

Exclusions (970 distinct)

Rules under this technique

Sigma 262 rules

Elastic 217 rules

Splunk 188 rules

Kusto 113 rules

YARA-L 37 rules

Panther 99 rules

Disable or Modify Tools `T1685`