Impair Defenses: Disable or Modify Tools

Agent Tesla has the capability to kill any running analysis processes and AV software.^[1]

Brave Prince terminates antimalware processes.^[2]

BRONZE BUTLER has incorporated code into several tools that attempts to terminate anti-virus processes.^[3]

Bundlore can change macOS security settings and browser preferences to enable follow-on behaviors.^[4]

Carberp has attempted to disable security software by creating a suspended process for the security software and injecting code to delete antivirus core files when the process is resumed.^[5]

ChChes can alter the victim's proxy configuration.^[6]

DarkComet can disable Security Center functions like anti-virus.^[7][8]

FIN6 has deployed a utility script named kill.bat to disable anti-virus.^[9]

Gamaredon Group has delivered macros which can tamper with Microsoft Office security settings.^[10]

Gold Dragon terminates anti-malware processes if they’re found running on the system.^[2]

Goopy has the ability to disable Microsoft Outlook's security policies to disable macro warnings.^[11]

Gorgon Group malware can attempt to disable security features in Microsoft Office and Windows Defender using the taskkill command.^[12]

H1N1 kills and disables services for Windows Security Center, and Windows Defender.^[13]

HDoor kills anti-virus found on the victim.^[14]

Imminent Monitor has a feature to disable Windows Task Manager.^[15]

JPIN can lower security settings by changing Registry keys.^[16]

Kimsuky has been observed turning off Windows Security Center.^[17]

Lazarus Group malware TangoDelta attempts to terminate various processes associated with McAfee. Additionally, Lazarus Group malware SHARPKNOT disables the Microsoft Windows System Event Notification and Alerter services.^{[18][19][20][21]}. During a 2019 intrusion, Lazarus Group disabled Windows Defender and Credential Guard as some of their first actions on host.^[22]

LockerGoga installation has been immediately preceded by a "task kill" command in order to disable anti-virus.^[23]

Maze has disabled dynamic analysis and other security tools including IDA debugger, x32dbg, and OllyDbg.^[24] It has also disabled Windows Defender's Real-Time Monitoring feature and attempted to disable endpoint protection services.^[25]

Metamorfo has a function to kill processes associated with defenses and can prevent certain processes from launching.^[26][27]

NanHaiShu can change Internet Explorer settings to reduce warnings about malware activity.^[28]

NanoCore can modify the victim's anti-virus.^[29][30]

Netwalker can detect and terminate active security software-related processes on infected systems.^[31][32]

Night Dragon has disabled anti-virus and anti-spyware tools in some instances on the victim’s machines. The actors have also disabled proxy settings to allow direct communication from victims to the Internet.^[33]

POWERSTATS can disable Microsoft Office Protected View by changing Registry keys.^[34]

Proton kills security tools like Wireshark that are running.^[35]

Malware used by Putter Panda attempts to terminate processes corresponding to two components of Sophos Anti-Virus (SAVAdminService.exe and SavService.exe).^[36]

Ragnar Locker has attempted to terminate/stop processes and services associated with endpoint security products.^[37]

REvil can connect to and disable the Symantec server on the victim's network.^[38]

RobbinHood will search for Windows services that are associated with antivirus software on the system and kill the process.^[39]

Rocke used scripts which detected and uninstalled antivirus software.^[40][41]

RunningRAT kills antimalware running process.^[2]

Ryuk has stopped services related to anti-virus.^[42]

Skidmap has the ability to set SELinux to permissive mode.^[43]

SslMM identifies and kills anti-malware processes.^[14]

StrongPity can add directories used by the malware to the Windows Defender exclusions list to prevent detection.^[44]

Sunburst attempted to disable software security services following checks against a FNV-1a + XOR hashed hardcoded blocklist.^[45]

TinyZBot can disable Avira anti-virus.^[46]

TrickBot can disable Windows Defender.^[47]

Turla has used a AMSI bypass, which patches the in-memory amsi.dll, in PowerShell scripts to bypass Windows antimalware products.^[48]

UNC2452 used the service control manager on a remote system to disable services associated with security monitoring products.^[49]

Unknown Logger has functionality to disable security tools, including Kaspersky, BitDefender, and MalwareBytes.^[50]

Wizard Spider has shut down or uninstalled security applications on victim systems that might prevent ransomware from executing.^[51][52][53]

ZxShell can kill AV products' processes.^[54]

Ensure proper process and file permissions are in place to prevent adversaries from disabling or interfering with security services.

Ensure proper Registry permissions are in place to prevent adversaries from disabling or interfering with security services.

Ensure proper user permissions are in place to prevent adversaries from disabling or interfering with security services.