T1685 Disable or Modify Tools
Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys,…
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
- NotPetya Ransomware Activitycriticaltest · windows
- RedSun - Named Pipe Createdcriticalexperimental · windows
- RedSun - TieringEngineService.exe Detected as EICAR Test Filecriticalexperimental · windows
- AWS SecurityHub Findings Evasionhighstable · aws
- Microsoft Defender Tamper Protection Triggerhighstable · windows
- Suspicious Eventlog Clearing or Configuration Change Activityhighstable · windows
- Windows Defender Configuration Changeshighstable · windows
- Windows Defender Grace Period Expiredhighstable · windows
- Windows Defender Malware And PUA Scanning Disabledhighstable · windows
- Windows Defender Real-time Protection Disabledhighstable · windows
- Windows Defender Virus Scanning Feature Disabledhighstable · windows
- AMSI Bypass Pattern Assembly GetTypehightest · windows
- AWS Config Disabling Channel/Recorderhightest · aws
- AWS GuardDuty Important Changehightest · aws
- Add SafeBoot Keys Via Reg Utilityhightest · windows
- Antivirus Filter Driver Disallowed On Dev Drive - Registryhightest · windows
- Audit Policy Tampering Via Auditpolhightest · windows
- Audit Policy Tampering Via NT Resource Kit Auditpolhightest · windows
- Auditing Configuration Changes on Linux Hosthightest · linux
- Bitbucket Secret Scanning Exempt Repository Addedhightest · bitbucket
- Change Winevt Channel Access Permission Via Registryhightest · windows
- Cisco Disabling Logginghightest · cisco
- Diamond Sleet APT Scheduled Task Creation - Registryhightest · windows
- Disable PUA Protection on Windows Defenderhightest · windows
- Disable Security Events Logging Adding Reg Key MiniNthightest · windows
Mostrando 25 de 81.
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.