attack.t1685

Add SafeBoot Keys Via Reg Utility

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. Often used by attacker to allow the ransomware to work in safe mode as some security products do not

AMSI Bypass Pattern Assembly GetType

Apr 28, 2026 · attack.defense-impairment attack.t1685 attack.execution ·

Share on:

Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts

AMSI Disabled via Registry Modification

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. Anti-Malware Scan Interface (AMSI) is a security feature in Windows that allows applications and services to integrate with anti-malware products for enhanced protection against malicious content. Adversaries may attempt to disable AMSI to evade detection by security software, allowing them to execute malicious scripts or code without being scanned.

Antivirus Filter Driver Disallowed On Dev Drive - Registry

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive".

ASLR Disabled Via Sysctl or Direct Syscall - Linux

Apr 28, 2026 · attack.privilege-escalation attack.stealth attack.defense-impairment attack.t1685 attack.t1055.009 ·

Share on:

Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including:

Use of the personality syscall with the ADDR_NO_RANDOMIZE flag (0x0040000)
Modification of the /proc/sys/kernel/randomize_va_space file
Execution of the sysctl command to set kernel.randomize_va_space=0 Disabling ASLR is often used by attackers during exploit development or to bypass memory protection mechanisms. A successful use of these methods can reduce the effectiveness of ASLR and make memory corruption attacks more reliable.

Auditing Configuration Changes on Linux Host

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detect changes in auditd configuration files

AWS GuardDuty Detector Deleted Or Updated

Apr 28, 2026 · attack.defense-impairment attack.t1685 attack.t1685.002 ·

Share on:

Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities. Upon deletion, GuardDuty stops monitoring the environment and all existing findings are lost. Verify with the user identity that this activity is legitimate.

AWS GuardDuty Important Change

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs.

AWS SecurityHub Findings Evasion

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects the modification of the findings on SecurityHub.

Azure Kubernetes Events Deleted

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects when Events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to evade detection.

Bitbucket Audit Log Configuration Updated

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects changes to the bitbucket audit log configuration.

Bitbucket Global Secret Scanning Rule Deleted

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects Bitbucket global secret scanning rule deletion activity.

Bitbucket Global SSH Settings Changed

Apr 28, 2026 · attack.lateral-movement attack.defense-impairment attack.t1685 attack.t1021.004 ·

Share on:

Detects Bitbucket global SSH access configuration changes.

Bitbucket Project Secret Scanning Allowlist Added

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects when a secret scanning allowlist rule is added for projects.

Bitbucket Secret Scanning Exempt Repository Added

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects when a repository is exempted from secret scanning feature.

Bitbucket Secret Scanning Rule Deleted

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects when secret scanning rule is deleted for the project or repository.

Cisco Disabling Logging

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Turn off logging locally or remote

Cisco Dot1x Disabled

Apr 28, 2026 · attack.persistence attack.credential-access attack.defense-impairment attack.t1685 attack.t1556.004 ·

Share on:

Detects the manual disablement of IEEE 802.1X (dot1x) on a Cisco network device interface. Disabling dot1x bypasses Network Access Control (NAC) mechanisms, potentially allowing unauthorized devices to gain access to the internal network. This activity is a common technique used by attackers or malicious insiders to establish persistence or perform lateral movement via rogue devices.

Devcon Execution Disabling VMware VMCI Device

Apr 28, 2026 · attack.persistence attack.privilege-escalation attack.defense-impairment attack.t1543.003 attack.t1685 ·

Share on:

Detects execution of devcon.exe with commands that disable the VMware Virtual Machine Communication Interface (VMCI) device. This can be legitimate during VMware Tools troubleshooting or driver conflicts, but may also indicate malware attempting to hijack communication with the hardware via the VMCI device. This has been used to facilitate VMware ESXi vulnerability exploits to escape VMs and execute code on the ESXi host.

Diamond Sleet APT Scheduled Task Creation - Registry

Apr 28, 2026 · attack.defense-impairment attack.t1685 detection.emerging-threats ·

Share on:

Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability

Disable Exploit Guard Network Protection on Windows Defender

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects disabling Windows Defender Exploit Guard Network Protection

Disable of ETW Trace - Powershell

Apr 28, 2026 · attack.stealth attack.defense-impairment attack.t1070 attack.t1685 car.2016-04-002 ·

Share on:

Detects usage of powershell cmdlets to disable or remove ETW trace sessions

Disable Or Stop Services

Apr 28, 2026 · attack.defense-impairment attack.t1685 attack.impact attack.t1489 ·

Share on:

Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services on Linux systems. Attackers may stop or disable security tools and services to evade detection, maintain persistence, or disrupt system operations.

Disable Privacy Settings Experience in Registry

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects registry modifications that disable Privacy Settings Experience

Disable PUA Protection on Windows Defender

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects disabling Windows Defender PUA protection

Disable Security Tools

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects disabling security tools

Disable Tamper Protection on Windows Defender

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects disabling Windows Defender Tamper Protection

Disable Windows Defender AV Security Monitoring

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects attackers attempting to disable Windows Defender using Powershell

Disable Windows Defender Functionalities Via Registry Keys

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects when attackers or tools disable Windows Defender functionalities via the Windows registry

Disable-WindowsOptionalFeature Command PowerShell

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detect built in PowerShell cmdlet Disable-WindowsOptionalFeature, Deployment Image Servicing and Management tool. Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images

Disabled IE Security Features

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer security features

Disabled Volume Snapshots

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects commands that temporarily turn off Volume Snapshots

Disabled Windows Defender Eventlog

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects the disabling of the Windows Defender eventlog as seen in relation to Lockbit 3.0 infections

Disabling Windows Defender WMI Autologger Session via Reg.exe

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects the use of reg.exe to disable the Event Tracing for Windows (ETW) Autologger session for Windows Defender API and Audit events. By setting the 'Start' value to '0' for the 'DefenderApiLogger' or 'DefenderAuditLogger' session, an attacker can prevent these critical security events from being logged, effectively blinding monitoring tools that rely on this data. This is a powerful defense evasion technique.

Dism Remove Online Package

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Deployment Image Servicing and Management tool. DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images

Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects enabling of the "AllowAnonymousCallback" registry value, which allows a remote connection between computers that do not have a trust relationship.

ESXi Syslog Configuration Change Via ESXCLI

Apr 28, 2026 · attack.execution attack.defense-impairment attack.t1685 attack.t1690 attack.t1059.012 ·

Share on:

Detects changes to the ESXi syslog configuration via "esxcli"

ETW Logging Disabled For rpcrt4.dll

Apr 28, 2026 · attack.persistence attack.defense-impairment attack.t1112 attack.t1685 ·

Share on:

Detects changes to the "ExtErrorInformation" key in order to disable ETW logging for rpcrt4.dll

ETW Logging Disabled For SCM

Apr 28, 2026 · attack.persistence attack.defense-impairment attack.t1112 attack.t1685 ·

Share on:

Detects changes to the "TracingDisabled" key in order to disable ETW logging for services.exe (SCM)

ETW Logging Disabled In .NET Processes - Registry

Apr 28, 2026 · attack.persistence attack.defense-impairment attack.t1112 attack.t1685 ·

Share on:

Potential adversaries stopping ETW providers recording loaded .NET assemblies.

ETW Logging Disabled In .NET Processes - Sysmon Registry

Apr 28, 2026 · attack.persistence attack.defense-impairment attack.t1112 attack.t1685 ·

Share on:

Potential adversaries stopping ETW providers recording loaded .NET assemblies.

ETW Logging Tamper In .NET Processes Via CommandLine

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects changes to environment variables related to ETW logging via the CommandLine. This could indicate potential adversaries stopping ETW providers recording loaded .NET assemblies.

ETW Trace Evasion Activity

Apr 28, 2026 · attack.stealth attack.defense-impairment attack.t1070 attack.t1685 car.2016-04-002 ·

Share on:

Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.

Filter Driver Unloaded Via Fltmc.EXE

Apr 28, 2026 · attack.stealth attack.defense-impairment attack.t1070 attack.t1685 attack.t1685.001 ·

Share on:

Detect filter driver unloading activity via fltmc.exe

Folder Removed From Exploit Guard ProtectedFolders List - Registry

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects the removal of folders from the "ProtectedFolders" list of of exploit guard. This could indicate an attacker trying to launch an encryption process or trying to manipulate data inside of the protected folder

FortiGate - Firewall Address Object Added

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects the addition of firewall address objects on a Fortinet FortiGate Firewall.

FortiGate - New Firewall Policy Added

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects the addition of a new firewall policy on a Fortinet FortiGate Firewall.

Github Push Protection Bypass Detected

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects when a user bypasses the push protection on a secret detected by secret scanning.

Github Push Protection Disabled

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects if the push protection feature is disabled for an organization, enterprise, repositories or custom pattern rules.

Github Secret Scanning Feature Disabled

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects if the secret scanning feature is disabled for an enterprise or repository.

Google Cloud Firewall Modified or Deleted

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects when a firewall rule is modified or deleted in Google Cloud Platform (GCP).

HackTool - CobaltStrike BOF Injection Pattern

Apr 28, 2026 · attack.execution attack.defense-impairment attack.t1106 attack.t1685 ·

Share on:

Detects a typical pattern of a CobaltStrike BOF which inject into other processes

Hacktool - EDR-Freeze Execution

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects execution of EDR-Freeze, a tool that exploits the MiniDumpWriteDump function and WerFaultSecure.exe to suspend EDR and Antivirus processes on Windows. EDR-Freeze leverages a race-condition attack to put security processes into a dormant state by suspending WerFaultSecure at the moment it freezes the target process. This technique does not require kernel-level exploits or BYOVD, but instead abuses user-mode functionality to temporarily disable monitoring by EDR or Antimalware solutions.

HackTool - EDRSilencer Execution

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects the execution of EDRSilencer, a tool that leverages Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server based on PE metadata information.

HackTool - EDRSilencer Execution - Filter Added

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic of running EDR agents based on specific hardcoded filter names.

HackTool - PowerTool Execution

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload drivers, and delete the driver files

HackTool - Stracciatella Execution

Apr 28, 2026 · attack.execution attack.defense-impairment attack.t1059 attack.t1685 ·

Share on:

Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.

Hide Schedule Task Via Index Value Tamper

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects when the "index" value of a scheduled task is modified from the registry Which effectively hides it from any tooling such as "schtasks /query" (Read the referenced link for more information about the effects of this technique)

Hypervisor Enforced Paging Translation Disabled

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects changes to the "DisableHypervisorEnforcedPagingTranslation" registry value. Where the it is set to "1" in order to disable the Hypervisor Enforced Paging Translation feature.

Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects the tampering of Hypervisor-protected Code Integrity (HVCI) related registry values via command line tool reg.exe. HVCI uses virtualization-based security to protect code integrity by ensuring that only trusted code can run in kernel mode. Adversaries may tamper with HVCI to load malicious or unsigned drivers, which can be used to escalate privileges, maintain persistence, or evade security mechanisms.

Kaspersky Endpoint Security Stopped Via CommandLine - Linux

Apr 28, 2026 · attack.execution attack.defense-impairment attack.t1685 ·

Share on:

Detects execution of the Kaspersky init.d stop script on Linux systems either directly or via systemctl. This activity may indicate a manual interruption of the antivirus service by an administrator, or it could be a sign of potential tampering or evasion attempts by malicious actors.

Load Of RstrtMgr.DLL By A Suspicious Process

Apr 28, 2026 · attack.impact attack.defense-impairment attack.t1486 attack.t1685 ·

Share on:

Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.

Load Of RstrtMgr.DLL By An Uncommon Process

Apr 28, 2026 · attack.impact attack.defense-impairment attack.t1486 attack.t1685 ·

Share on:

Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.

Logging Configuration Changes on Linux Host

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detect changes of syslog daemons configuration files

Microsoft Defender Tamper Protection Trigger

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects blocked attempts to change any of Defender's settings such as "Real Time Monitoring" and "Behavior Monitoring"

Microsoft Malware Protection Engine Crash

Apr 28, 2026 · attack.stealth attack.defense-impairment attack.t1211 attack.t1685 ·

Share on:

This rule detects a suspicious crash of the Microsoft Malware Protection Engine

Microsoft Malware Protection Engine Crash - WER

Apr 28, 2026 · attack.stealth attack.defense-impairment attack.t1211 attack.t1685 ·

Share on:

This rule detects a suspicious crash of the Microsoft Malware Protection Engine

Microsoft Office Protected View Disabled

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature.

NetNTLM Downgrade Attack

Apr 28, 2026 · attack.persistence attack.defense-impairment attack.t1685 attack.t1112 ·

Share on:

Detects NetNTLM downgrade attack

NetNTLM Downgrade Attack - Registry

Apr 28, 2026 · attack.persistence attack.defense-impairment attack.t1685 attack.t1112 ·

Share on:

Detects NetNTLM downgrade attack

Obfuscated PowerShell OneLiner Execution

Apr 28, 2026 · attack.execution attack.defense-impairment attack.t1059.001 attack.t1685 ·

Share on:

Detects the execution of a specific OneLiner to download and execute powershell modules in memory.

Okta User Session Start Via An Anonymising Proxy Service

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects when an Okta user session starts where the user is behind an anonymising proxy service.

Potential AMSI Bypass Script Using NULL Bits

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities

Potential AMSI Bypass Using NULL Bits

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities

Potential AMSI Bypass Via .NET Reflection

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects Request to "amsiInitFailed" that can be used to disable AMSI Scanning

Potential AMSI COM Server Hijacking

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects changes to the AMSI come server registry key in order disable AMSI scanning functionalities. When AMSI attempts to starts its COM component, it will query its registered CLSID and return a non-existent COM server. This causes a load failure and prevents any scanning methods from being accessed, ultimately rendering AMSI useless

Potential Ke3chang/TidePool Malware Activity

Apr 28, 2026 · attack.defense-impairment attack.g0004 attack.t1685 detection.emerging-threats ·

Share on:

Detects registry modifications potentially related to the Ke3chang/TidePool malware as seen in campaigns running in 2019 and 2020

Potential Privileged System Service Operation - SeLoadDriverPrivilege

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects the usage of the 'SeLoadDriverPrivilege' privilege. This privilege is required to load or unload a device driver. With this privilege, the user can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. If you exclude privileged users/admins and processes, which are allowed to do so, you are maybe left with bad programs trying to load malicious kernel drivers. This will detect Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs) and the usage of Sysinternals and various other tools. So you have to work with a whitelist to find the bad stuff.

Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

Potential Tampering With Security Products Via WMIC

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects uninstallation or termination of security products using the WMIC utility

Potential Windows Defender Tampering Via Wmic.EXE

Apr 28, 2026 · attack.execution attack.defense-impairment attack.t1047 attack.t1685 ·

Share on:

Detects potential tampering with Windows Defender settings such as adding exclusion using wmic

Powershell Base64 Encoded MpPreference Cmdlet

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects base64 encoded "MpPreference" PowerShell cmdlet code that tries to modifies or tamper with Windows Defender AV

Powershell Defender Disable Scan Feature

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects requests to disable Microsoft Defender features using PowerShell commands

Powershell Defender Exclusion

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects requests to exclude files, folders or processes from Antivirus scanning using PowerShell cmdlets

PowerShell Defender Threat Severity Default Action Set to 'Allow' or 'NoAction'

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects the use of PowerShell to execute the 'Set-MpPreference' cmdlet to configure Windows Defender's threat severity default action to 'Allow' (value '6') or 'NoAction' (value '9'). This is a highly suspicious configuration change that effectively disables Defender's ability to automatically mitigate threats of a certain severity level. An attacker might use this technique via the command line to bypass defenses before executing payloads.

PPL Tampering Via WerFaultSecure

Apr 28, 2026 · attack.defense-impairment attack.t1685 attack.credential-access attack.t1003.001 ·

Share on:

Detects potential abuse of WerFaultSecure.exe to dump Protected Process Light (PPL) processes like LSASS or to freeze security solutions (EDR/antivirus). This technique is used by tools such as EDR-Freeze and WSASS to bypass PPL protections and access sensitive information or disable security software. Distinct command line patterns help identify the specific tool:

WSASS usage typically shows: "WSASS.exe WerFaultSecure.exe [PID]" in ParentCommandLine
EDR-Freeze usage typically shows: "EDR-Freeze_[version].exe [PID] [timeout]" in ParentCommandLine Legitimate debugging operations using WerFaultSecure are rare in production environments and should be investigated.

PUA - CleanWipe Execution

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects the use of CleanWipe a tool usually used to delete Symantec antivirus.

Python Function Execution Security Warning Disabled In Excel

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed. Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.

Python Function Execution Security Warning Disabled In Excel - Registry

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed. Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.

Raccine Uninstall

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects commands that indicate a Raccine removal from an end system. Raccine is a free ransomware protection tool.

RedSun - Named Pipe Created

Apr 28, 2026 · attack.privilege-escalation attack.stealth attack.defense-impairment attack.t1055 attack.t1685 detection.emerging-threats ·

Share on:

Detects the creation of a named pipe with the hardcoded name "REDSUN". The RedSun exploit tool uses a pipe with this name for synchronisation and command communication between its components during the Cloud Files API + oplock-based AV bypass and privilege escalation chain. RedSun creates the pipe as \??\pipe\REDSUN. The pipe server listens for the token-duplicated elevated process to connect and respond, completing the privilege escalation from user to SYSTEM. Presence of this pipe name indicates active or recent RedSun execution.

RedSun - TieringEngineService.exe Detected as EICAR Test File

Apr 28, 2026 · attack.stealth attack.defense-impairment attack.t1036.005 attack.t1685 attack.privilege-escalation attack.t1055 detection.emerging-threats ·

Share on:

Detects Windows Defender (EventID 1119 - Remediation Action Failed) flagging TieringEngineService.exe dropped in a characteristic RS-{GUID} temporary directory, or the RedSun.exe process itself being present. This covers the staging pattern used by RedSun, a Cloud Files API and opportunistic lock (oplock) based AV bypass/privilege escalation tool.

RedSun works as follows:

Registers a Cloud Files sync root and creates a Cloud Files placeholder for TieringEngineService.exe under %TEMP%\RS-{GUID}\
The placeholder file carries EICAR test file content (Virus:DOS/EICAR_Test_File) to reliably trigger a Defender scan and remediation attempt
Requests a batch oplock (FSCTL_REQUEST_BATCH_OPLOCK) on the placeholder file
When Defender attempts to scan/quarantine the file, the oplock triggers - holding the file open
During the oplock break window, RedSun swaps the mount point (junction) to redirect \?\C:\Windows\System32 to the attacker-controlled temp path
This races the AV/OS into executing the malicious TieringEngineService.exe with elevated privileges

Reg Add Suspicious Paths

Apr 28, 2026 · attack.persistence attack.defense-impairment attack.t1112 attack.t1685 ·

Share on:

Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys

Removal Of AMSI Provider Registry Keys

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects the deletion of AMSI provider registry key entries in HKLM\Software\Microsoft\AMSI. This technique could be used by an attacker in order to disable AMSI inspection.

Removal Of Index Value to Hide Schedule Task - Registry

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects when the "index" value of a scheduled task is removed or deleted from the registry. Which effectively hides it from any tooling such as "schtasks /query"

Removal Of SD Value to Hide Schedule Task - Registry

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Remove SD (Security Descriptor) value in \Schedule\TaskCache\Tree registry hive to hide schedule task. This technique is used by Tarrask malware

SafeBoot Registry Key Deleted Via Reg.EXE

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects execution of "reg.exe" commands with the "delete" flag on safe boot registry keys. Often used by attacker to prevent safeboot execution of security products

Scripted Diagnostics Turn Off Check Enabled - Registry

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects enabling TurnOffCheck which can be used to bypass defense of MSDT Follina vulnerability

Security Service Disabled Via Reg.EXE

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects execution of "reg.exe" to disable security services such as Windows Defender.

Service Registry Key Deleted Via Reg.EXE

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects execution of "reg.exe" commands with the "delete" flag on services registry key. Often used by attacker to remove AV software services

Service Startup Type Change Via Wmic.EXE

Apr 28, 2026 · attack.execution attack.defense-impairment attack.t1047 attack.t1685 ·

Share on:

Detects changes to service startup type to 'disabled' or 'manual' using the WMIC command-line utility.

Service StartupType Change Via PowerShell Set-Service

Apr 28, 2026 · attack.execution attack.defense-impairment attack.t1685 ·

Share on:

Detects the use of the PowerShell "Set-Service" cmdlet to change the startup type of a service to "disabled" or "manual"

Service StartupType Change Via Sc.EXE

Apr 28, 2026 · attack.execution attack.defense-impairment attack.t1685 ·

Share on:

Detect the use of "sc.exe" to change the startup type of a service to "disabled" or "demand"

Suspicious Application Allowed Through Exploit Guard

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects applications being added to the "allowed applications" list of exploit guard in order to bypass controlled folder settings

Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location

Apr 28, 2026 · attack.credential-access attack.defense-impairment attack.t1003 attack.t1685 ·

Share on:

Detects loading of dbgcore.dll or dbghelp.dll from uncommon locations such as user directories. These DLLs contain the MiniDumpWriteDump function, which can be abused for credential dumping purposes or in some cases for evading EDR/AV detection by suspending processes.

Suspicious Path In Keyboard Layout IME File Registry Value

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message. Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path. IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.

Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects process access events where WerFaultSecure accesses MsMpEng.exe with dbgcore.dll or dbghelp.dll in the call trace, indicating potential EDR freeze techniques. This technique leverages WerFaultSecure.exe running as a Protected Process Light (PPL) with WinTCB protection level to call MiniDumpWriteDump and suspend EDR/AV processes, allowing malicious activity to execute undetected during the suspension period.

Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs

Apr 28, 2026 · attack.credential-access attack.defense-impairment attack.t1003.001 attack.t1685 ·

Share on:

Detects suspicious process access to LSASS.exe from processes located in uncommon locations with dbgcore.dll or dbghelp.dll in the call trace. These DLLs contain functions like MiniDumpWriteDump that can be abused for credential dumping purposes. While modern tools like Mimikatz have moved to using ntdll.dll, dbgcore.dll and dbghelp.dll are still used by basic credential dumping utilities and legacy tools for LSASS memory access and process suspension techniques.

Suspicious PROCEXP152.sys File Created In TMP

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder. This driver is used by Sysinternals Process Explorer but also by KDU (https://github.com/hfiref0x/KDU) or Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU.

Suspicious Service Installed

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects installation of NalDrv or PROCEXP152 services via registry-keys to non-system32 folders. Both services are used in the tool Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU (https://github.com/hfiref0x/KDU)

Suspicious Uninstall of Windows Defender Feature via PowerShell

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects the use of PowerShell with Uninstall-WindowsFeature or Remove-WindowsFeature cmdlets to disable or remove the Windows Defender GUI feature, a common technique used by adversaries to evade defenses.

Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects the usage of "reg.exe" to add Defender folder exclusions. Qbot has been seen using this technique to add exclusions for folders within AppData and ProgramData.

Suspicious Windows Defender Registry Key Tampering Via Reg.EXE

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects the usage of "reg.exe" to tamper with different Windows Defender registry keys in order to disable some important features related to protection and detection

Suspicious Windows Service Tampering

Apr 28, 2026 · attack.impact attack.defense-impairment attack.t1489 attack.t1685 ·

Share on:

Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts

Suspicious Windows Trace ETW Session Tamper Via Logman.EXE

Apr 28, 2026 · attack.defense-impairment attack.t1685 attack.t1685.005 ·

Share on:

Detects the execution of "logman" utility in order to disable or delete Windows trace sessions

Sysinternals PsSuspend Suspicious Execution

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects suspicious execution of Sysinternals PsSuspend, where the utility is used to suspend critical processes such as AV or EDR to bypass defenses

Sysmon Application Crashed

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects application popup reporting a failure of the Sysmon service

Sysmon Configuration Update

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects updates to Sysmon's configuration. Attackers might update or replace the Sysmon configuration with a bare bone one to avoid monitoring without shutting down the service completely

Sysmon Driver Altitude Change

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects changes in Sysmon driver altitude value. If the Sysmon driver is configured to load at an altitude of another registered service, it will fail to load at boot.

Sysmon Driver Unloaded Via Fltmc.EXE

Apr 28, 2026 · attack.stealth attack.defense-impairment attack.t1070 attack.t1685 attack.t1685.001 ·

Share on:

Detects possible Sysmon filter driver unloaded via fltmc.exe

Tamper Windows Defender - PSClassic

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.

Tamper Windows Defender - ScriptBlockLogging

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects PowerShell scripts attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.

Tamper Windows Defender Remove-MpPreference

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects attempts to remove Windows Defender configurations using the 'MpPreference' cmdlet

Tamper Windows Defender Remove-MpPreference - ScriptBlockLogging

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects attempts to remove Windows Defender configuration using the 'MpPreference' cmdlet

Tamper With Sophos AV Registry Keys

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects tamper attempts to sophos av functionality via registry key modification

Taskkill Symantec Endpoint Protection

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects one of the possible scenarios for disabling Symantec Endpoint Protection. Symantec Endpoint Protection antivirus software services incorrectly implement the protected service mechanism. As a result, the NT AUTHORITY/SYSTEM user can execute the taskkill /im command several times ccSvcHst.exe /f, thereby killing the process belonging to the service, and thus shutting down the service.

Uncommon Extension In Keyboard Layout IME File Registry Value

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message. Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path. IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.

Uninstall Crowdstrike Falcon Sensor

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Adversaries may disable security tools to avoid possible detection of their tools and activities by uninstalling Crowdstrike Falcon

Uninstall Sysinternals Sysmon

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects the removal of Sysmon, which could be a potential attempt at defense evasion

Vulnerable Driver Blocklist Registry Tampering Via CommandLine

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects tampering of the Vulnerable Driver Blocklist registry via command line tools such as PowerShell or REG.EXE. The Vulnerable Driver Blocklist is a security feature that helps prevent the loading of known vulnerable drivers. Disabling this feature may indicate an attempt to bypass security controls, often targeted by threat actors to facilitate the installation of malicious or vulnerable drivers, particularly in scenarios involving Endpoint Detection and Response

Weak Encryption Enabled and Kerberoast

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects scenario where weak encryption is enabled for a user profile which could be used for hash/password cracking.

WFP Filter Added via Registry

Apr 28, 2026 · attack.execution attack.defense-impairment attack.t1685 attack.t1569.002 ·

Share on:

Detects registry modifications that add Windows Filtering Platform (WFP) filters, which may be used to block security tools and EDR agents from reporting events.

Win Defender Restored Quarantine File

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects the restoration of files from the defender quarantine

Windows AMSI Related Registry Tampering Via CommandLine

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects tampering of AMSI (Anti-Malware Scan Interface) related registry values via command line tools such as reg.exe or PowerShell. AMSI provides a generic interface for applications and services to integrate with antimalware products. Adversaries may disable AMSI to evade detection of malicious scripts and code execution.

Windows Credential Guard Disabled - Registry

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects attempts to disable Windows Credential Guard by setting registry values to 0. Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation.

Windows Credential Guard Registry Tampering Via CommandLine

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects attempts to add, modify, or delete Windows Credential Guard related registry keys or values via command line tools such as Reg.exe or PowerShell. Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation. The rule matches suspicious command lines that target DeviceGuard or LSA registry paths and manipulate keys like EnableVirtualizationBasedSecurity, RequirePlatformSecurityFeatures, or LsaCfgFlags. Such activity may indicate an attempt to disable or tamper with Credential Guard, potentially exposing sensitive credentials for misuse.

Windows Credential Guard Related Registry Value Deleted - Registry

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects attempts to disable Windows Credential Guard by deleting registry values. Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation.

Windows Defender Configuration Changes

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects suspicious changes to the Windows Defender configuration

Windows Defender Context Menu Removed

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects the use of reg.exe or PowerShell to delete the Windows Defender context menu handler registry keys. This action removes the "Scan with Microsoft Defender" option from the right-click menu for files, directories, and drives. Attackers may use this technique to hinder manual, on-demand scans and reduce the visibility of the security product.

Windows Defender Definition Files Removed

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Adversaries may disable security tools to avoid possible detection of their tools and activities by removing Windows Defender Definition Files

Windows Defender Exclusion List Modified

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects modifications to the Windows Defender exclusion registry key. This could indicate a potentially suspicious or even malicious activity by an attacker trying to add a new exclusion in order to bypass security.

Windows Defender Exclusion Registry Key - Write Access Requested

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects write access requests to the Windows Defender exclusions registry keys. This could be an indication of an attacker trying to request a handle or access the object to write new exclusions in order to bypass security.

Windows Defender Exclusions Added

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects the Setting of Windows Defender Exclusions

Windows Defender Exclusions Added - PowerShell

Apr 28, 2026 · attack.defense-impairment attack.t1685 attack.execution attack.t1059 ·

Share on:

Detects modifications to the Windows Defender configuration settings using PowerShell to add exclusions

Windows Defender Exclusions Added - Registry

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects the Setting of Windows Defender Exclusions

Windows Defender Exploit Guard Tamper

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects when someone is adding or removing applications or folders from exploit guard "ProtectedFolders" or "AllowedApplications"

Windows Defender Grace Period Expired

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects the expiration of the grace period of Windows Defender. This means protection against viruses, spyware, and other potentially unwanted software is disabled.

Windows Defender Malware And PUA Scanning Disabled

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects disabling of the Windows Defender feature of scanning for malware and other potentially unwanted software

Windows Defender Real-time Protection Disabled

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects disabling of Windows Defender Real-time Protection. As this event doesn't contain a lot of information on who initiated this action you might want to reduce it to a "medium" level if this occurs too many times in your environment

Windows Defender Real-Time Protection Failure/Restart

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects issues with Windows Defender Real-Time Protection features

Windows Defender Service Disabled - Registry

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects when an attacker or tool disables the Windows Defender service (WinDefend) via the registry

Windows Defender Submit Sample Feature Disabled

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects disabling of the "Automatic Sample Submission" feature of Windows Defender.

Windows Defender Threat Detection Service Disabled

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects when the "Windows Defender Threat Protection" service is disabled.

Windows Defender Threat Severity Default Action Modified

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects modifications or creations of Windows Defender's default threat action settings based on severity to 'allow' or take 'no action'. This is a highly suspicious configuration change that effectively disables Defender's ability to automatically mitigate threats of a certain severity level, allowing malicious software to run unimpeded. An attacker might use this technique to bypass defenses before executing payloads.

Windows Defender Virus Scanning Feature Disabled

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects disabling of the Windows Defender virus scanning feature

Windows Filtering Platform Blocked Connection From EDR Agent Binary

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects a Windows Filtering Platform (WFP) blocked connection event involving common Endpoint Detection and Response (EDR) agents. Adversaries may use WFP filters to prevent Endpoint Detection and Response (EDR) agents from reporting security events.

Windows Firewall Disabled via PowerShell

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects attempts to disable the Windows Firewall using PowerShell

Windows Hypervisor Enforced Code Integrity Disabled

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects changes to the HypervisorEnforcedCodeIntegrity registry key and the "Enabled" value being set to 0 in order to disable the Hypervisor Enforced Code Integrity feature. This allows an attacker to load unsigned and untrusted code to be run in the kernel

Windows Vulnerable Driver Blocklist Disabled

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects when the Windows Vulnerable Driver Blocklist is set to disabled. This setting is crucial for preventing the loading of known vulnerable drivers, and its modification may indicate an attempt to bypass security controls. It is often targeted by threat actors to facilitate the installation of malicious or vulnerable drivers, particularly in scenarios involving Endpoint Detection and Response (EDR) bypass techniques. This rule applies to systems that support the Vulnerable Driver Blocklist feature, including Windows 10 version 1903 and later, and Windows Server 2022 and later. Note that this change will require a reboot to take effect, and this rule only detects the registry modification action.

Write Protect For Storage Disabled

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Detects applications trying to modify the registry in order to disable any write-protect property for storage devices. This could be a precursor to a ransomware attack and has been an observed technique used by cypherpunk group.