Applied Cybernetics Group
T1685 Disable or Modify Tools
- Technique
T1685- Tactics
- Defense Evasion
- Research, 90 days
- 1
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 162
- Elastic, Splunk
- 122
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1685
MITRE description
Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.(Citation: SCADAfence_ransomware) In addition to directly targeting tools, adversaries may block or manipulate indicators and telemetry used for detection. This includes maliciously disabling or redirecting sensors such as Event Tracing for Windows (ETW), modifying event log configurations (e.g., redirecting Security logs), or interfering with logging pipelines and forwarding mechanisms (e.g., SIEM ingestion).(Citation: Microsoft Lamin Sept 2017)(Citation: ETW Palantir) More advanced techniques include leveraging legitimate drivers or debugging mechanisms to render tools non-functional, bypassing anti-tampering protections, and targeting specific defenses such as Sysmon or cloud monitoring agents. Adversaries may also disrupt broader defensive operations, including update mechanisms, logging infrastructure (e.g., syslog), or event aggregation, further degrading an organization’s ability to detect and respond to malicious activity.(Citation: Cocomazzi FIN7 Reboot)
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-09-21Kaspersky Securelist: Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO
Detection coverage
SigmaHQ community rules
- Potential Ke3chang/TidePool Malware Activity (emerging-threats)
- Diamond Sleet APT Scheduled Task Creation - Registry (emerging-threats)
- RedSun - Named Pipe Created (emerging-threats)
- RedSun - TieringEngineService.exe Detected as EICAR Test File (emerging-threats)
- Terminate Linux Process Via Kill (threat-hunting)
- WDAC Policy File Creation In CodeIntegrity Folder (threat-hunting)
- WerFaultSecure Loading DbgCore or DbgHelp - EDR-Freeze (threat-hunting)
- Bitbucket Global Secret Scanning Rule Deleted (core)
- Bitbucket Global SSH Settings Changed (core)
- Bitbucket Audit Log Configuration Updated (core)
- Bitbucket Project Secret Scanning Allowlist Added (core)
- Bitbucket Secret Scanning Exempt Repository Added (core)
- Bitbucket Secret Scanning Rule Deleted (core)
- Github Push Protection Bypass Detected (core)
- Github Push Protection Disabled (core)
- Github Secret Scanning Feature Disabled (core)
- AWS GuardDuty Detector Deleted Or Updated (core)
- AWS GuardDuty Important Change (core)
- AWS SecurityHub Findings Evasion (core)
- Azure Kubernetes Events Deleted (core)
- Google Cloud Firewall Modified or Deleted (core)
- Okta User Session Start Via An Anonymising Proxy Service (core)
- ASLR Disabled Via Sysctl or Direct Syscall - Linux (core)
- Auditing Configuration Changes on Linux Host (core)
- Logging Configuration Changes on Linux Host (core)
Showing 25 of 162 community rules.
the full set is tagged attack.t1685 in
SigmaHQ.
Elastic and Splunk rules
- Cisco ASA - Core Syslog Message Volume Drop (splunk)
- Cisco ASA - Logging Disabled via CLI (splunk)
- Cisco ASA - Logging Filters Configuration Tampering (splunk)
- ESXi Download Errors (splunk)
- ESXi Encryption Settings Modified (splunk)
- ESXi Lockdown Mode Disabled (splunk)
- ESXi Loghost Config Tampering (splunk)
- ESXi VIB Acceptance Level Tampering (splunk)
- M365 Copilot Agentic Jailbreak Attack (splunk)
- M365 Copilot Impersonation Jailbreak Attack (splunk)
- M365 Copilot Information Extraction Jailbreak Attack (splunk)
- M365 Copilot Jailbreak Attempts (splunk)
- M365 Copilot Non Compliant Devices Accessing M365 Copilot (splunk)
- Azure AD Block User Consent For Risky Apps Disabled (splunk)
- GitHub Enterprise Delete Branch Ruleset (splunk)
- GitHub Enterprise Disable 2FA Requirement (splunk)
- GitHub Enterprise Disable Classic Branch Protection Rule (splunk)
- GitHub Enterprise Disable Dependabot (splunk)
- GitHub Enterprise Disable IP Allow List (splunk)
- GitHub Enterprise Register Self Hosted Runner (splunk)
- GitHub Organizations Delete Branch Ruleset (splunk)
- GitHub Organizations Disable 2FA Requirement (splunk)
- GitHub Organizations Disable Classic Branch Protection Rule (splunk)
- GitHub Organizations Disable Dependabot (splunk)
- Microsoft Intune DeviceManagementConfigurationPolicies (splunk)
Showing 25 of 122.