Impair Defenses: Disable or Modify Tools

Agent Tesla has the capability to kill any running analysis processes and AV software.^[13]

Brave Prince terminates antimalware processes.^[10]

BRONZE BUTLER has incorporated code into several tools that attempts to terminate anti-virus processes.^[41]

Bundlore can change macOS security settings and browser preferences to enable follow-on behaviors.^[29]

ChChes can alter the victim's proxy configuration.^[2]

DarkComet can disable Security Center functions like anti-virus.^[14][15]

Gamaredon Group has delivered macros which can tamper with Microsoft Office security settings.^[42]

Gold Dragon terminates anti-malware processes if they’re found running on the system.^[10]

Goopy has the ability to disable Microsoft Outlook's security policies to disable macro warnings.^[27]

Gorgon Group malware can attempt to disable security features in Microsoft Office and Windows Defender using the taskkill command.^[30]

H1N1 kills and disables services for Windows Security Center, and Windows Defender.^[3]

HDoor kills anti-virus found on the victim.^[4]

Imminent Monitor has a feature to disable Windows Task Manager.^[1]

JPIN lower disable security settings by changing Registry keys.^[6]

Kimsuky has been observed turning off Windows Security Center.^[38]

netsh. Lazarus Group malware TangoDelta attempts to terminate various processes associated with McAfee. Additionally, Lazarus Group malware SHARPKNOT disables the Microsoft Windows System Event Notification and Alerter services.^{[32][33][34][35]}

LockerGoga installation has been immediately preceded by a "task kill" command in order to disable anti-virus.^[18]

MAZE has disabled dynamic analysis and other security tools including IDA debugger, x32dbg, and OllyDbg.^[23]

NanHaiShu can change Internet Explorer settings to reduce warnings about malware activity.^[5]

NanoCore can modify the victim's anti-virus.^[8][9]

Netwalker can detect and terminate active security software-related processes on infected systems.^[24][25]

Night Dragon has disabled anti-virus and anti-spyware tools in some instances on the victim’s machines. The actors have also disabled proxy settings to allow direct communication from victims to the Internet.[^[36]

OSX/Shlayer can disable Gatekeeper using the native spctl application.^[20]

POWERSTATS can disable Microsoft Office Protected View by changing Registry keys.^[17]

Proton kills security tools like Wireshark that are running.^[11]

Malware used by Putter Panda attempts to terminate processes corresponding to two components of Sophos Anti-Virus (SAVAdminService.exe and SavService.exe).^[31]

Ragnar Locker has attempted to terminate/stop processes and services associated with endpoint security products.^[28]

RobbinHood will search for Windows services that are associated with antivirus software on the system and kill the process.^[19]

Rocke used scripts which detected and uninstalled antivirus software.^[39][40]

RunningRAT kills antimalware running process.^[10]

Ryuk has stopped services related to anti-virus.^[22]

Skidmap has the ability to set SELinux to permissive mode.^[26]

SslMM identifies and kills anti-malware processes.^[4]

TinyZBot can disable Avira anti-virus.^[7]

TrickBot can disable Windows Defender.^[12]

Turla has used a AMSI bypass, which patches the in-memory amsi.dll, in PowerShell scripts to bypass Windows antimalware products.^[37]

Unknown Logger has functionality to disable security tools, including Kaspersky, BitDefender, and MalwareBytes.^[16]

ZxShell can kill AV products' processes.^[21]

Ensure proper process and file permissions are in place to prevent adversaries from disabling or interfering with security services.

Ensure proper Registry permissions are in place to prevent adversaries from disabling or interfering with security services.

Ensure proper user permissions are in place to prevent adversaries from disabling or interfering with security services.