MITRE ATT&CKtechnique

T1685 Disable or Modify Tools

Published 2026-04-14 Modified 2026-09-11 Official page ↗
Domain
enterprise
Tactics
Defense Impairment
Platforms
Containers, ESXi, IaaS, Linux, macOS, Network Devices, Windows
Version
1.0
Created
2026-04-14

Description

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments. In addition to directly targeting tools, adversaries may block or manipulate indicators and telemetry used for detection. This includes maliciously disabling or redirecting sensors such as Event Tracing for Windows (ETW), modifying event log configurations (e.g., redirecting Security logs), or interfering with logging pipelines and forwarding mechanisms (e.g., SIEM ingestion). More advanced techniques include leveraging legitimate drivers or debugging mechanisms to render tools non-functional, bypassing anti-tampering protections, and targeting specific defenses such as Sysmon or cloud monitoring agents. Adversaries may also disrupt broader defensive operations, including update mechanisms, logging infrastructure (e.g., syslog), or event aggregation, further degrading an organization’s ability to detect and respond to malicious activity.

Related

Tactic · MITRE ATT&CK (1)

  • TA0112 Defense Impairment tactic

Referenced by MITRE ATT&CK · mitigates (7)

  • M1054 Software Configuration mitigation
  • M1038 Execution Prevention mitigation
  • M1042 Disable or Remove Feature or Program mitigation
  • M1047 Audit mitigation
  • M1018 User Account Management mitigation
  • M1022 Restrict File and Directory Permissions mitigation
  • M1024 Restrict Registry Permissions mitigation

Referenced by MITRE ATT&CK · subtechnique of (7)

  • T1685.007 Impair Autonomous Defenses sub-technique
  • T1685.001 Disable or Modify Windows Event Log sub-technique
  • T1685.002 Disable or Modify Cloud Log sub-technique
  • T1685.003 Modify or Spoof Tool UI sub-technique
  • T1685.004 Disable or Modify Linux Audit System Log sub-technique
  • T1685.005 Clear Windows Event Logs sub-technique
  • T1685.006 Clear Linux or Mac System Logs sub-technique

Referenced by MITRE ATT&CK · uses (131)

  • S9051 The Gentlemen Ransomware software (malware)
  • S9050 Vidar software (malware)
  • S9039 LazyWiper software (malware)
  • G1054 MirrorFace group
  • S9024 SPAWNCHIMERA software (malware)
  • S9014 PHASEJAM software (malware)
  • S9017 DCRAT software (tool)
  • S9019 PureCrypter software (malware)
  • S9013 DRYHOOK software (malware)
  • S9008 Shai-Hulud software (malware)
  • G1052 Contagious Interview group
  • S1244 Medusa Ransomware software (malware)
  • C0058 SharePoint ToolShell Exploitation campaign
  • G1051 Medusa Group group
  • S1242 Qilin software (malware)
  • S1240 RedLine Stealer software (malware)
  • S1234 SplatCloak software (malware)
  • C0055 Quad7 Activity campaign
  • G1048 UNC3886 group
  • S1213 Lumma Stealer software (malware)
  • G1047 Velvet Ant group
  • S1207 XLoader software (malware)
  • S1206 JumbledPath software (malware)
  • G1045 Salt Typhoon group
  • S1202 LockBit 3.0 software (malware)
  • S1200 StealBit software (malware)
  • S1199 LockBit 2.0 software (malware)
  • C0046 ArcaneDoor campaign
  • S1184 BOLDMOVE software (malware)
  • S1180 BlackByte Ransomware software (malware)
Show all 131 ›

Referenced by Compliance · mitigates (2)

  • CIS-16.7 Use Standard Hardening Configuration Templates for Application Infrastructure CIS Safeguard v8.1
  • CIS-18.3 Remediate Penetration Test Findings CIS Safeguard v8.1

References