value:  ChChes can alter the victim's proxy configuration. ;; Cobalt Strike has the ability to use Smart Applet attacks to disable the Java SecurityManager sandbox. ;; DarkComet can disable Security Center functions like anti-virus. ;; Ebury can disable SELinux Role-Based Access Control and deactivate PAM modules. ;; Egregor has disabled Windows Defender to evade protections. ;; FIN6 has deployed a utility script named kill.bat to disable anti-virus. ;; Gamaredon Group has delivered macros which can tamper with Microsoft Office security settings. ;; Gold Dragon terminates anti-malware processes if they’re found running on the system. ;; Goopy has the ability to disable Microsoft Outlook's security policies to disable macro warnings. ;; Gorgon Group malware can attempt to disable security features in Microsoft Office and Windows Defender using the taskkill command. ;; Grandoreiro can hook APIs kill processes break file system paths and change ACLs to prevent security tools from running. ;; H1N1 kills and disables services for Windows Security Center and Windows Defender. ;; HDoor kills anti-virus found on the victim. ;; Hildegard has modified DNS resolvers to evade DNS monitoring tools. ;; Imminent Monitor has a feature to disable Windows Task Manager. ;; JPIN can lower security settings by changing Registry keys. ;; Kimsuky has been observed turning off Windows Security Center. ;; Lazarus Group malware TangoDelta attempts to terminate various processes associated with McAfee. Additionally Lazarus Group malware SHARPKNOT disables the Microsoft Windows System Event Notification and Alerter services.. During a 2019 intrusion Lazarus Group disabled Windows Defender and Credential Guard as some of their first actions on host. ;; LockerGoga installation has been immediately preceded by a task kill" command in order to disable anti-virus. ;; Maze has disabled dynamic analysis and other security tools including IDA debugger x32dbg and OllyDbg. It has also disabled Windows Defender's Real-Time Monitoring feature and attempted to disable endpoint protection services. ;; MegaCortex was used to kill endpoint security processes. ;; Metamorfo has a function to kill processes associated with defenses and can prevent certain processes from launching. ;; MuddyWater can disable the system's local proxy settings. ;; NanHaiShu can change Internet Explorer settings to reduce warnings about malware activity. ;; NanoCore can modify the victim's anti-virus. ;; Netwalker can detect and terminate active security software-related processes on infected systems. ;; Night Dragon has disabled anti-virus and anti-spyware tools in some instances on the victim’s machines. The actors have also disabled proxy settings to allow direct communication from victims to the Internet. ;; POWERSTATS can disable Microsoft Office Protected View by changing Registry keys. ;; Proton kills security tools like Wireshark that are running. ;; Malware used by Putter Panda attempts to terminate processes corresponding to two components of Sophos Anti-Virus (SAVAdminService.exe and SavService.exe). ;; Pysa has the capability to stop antivirus services and disable Windows Defender. ;; Ragnar Locker has attempted to terminate/stop processes and services associated with endpoint security products. ;; REvil can connect to and disable the Symantec server on the victim's network. ;; RobbinHood will search for Windows services that are associated with antivirus software on the system and kill the process. ;; Rocke used scripts which detected and uninstalled antivirus software. ;; RunningRAT kills antimalware running process. ;; Ryuk has stopped services related to anti-virus. ;; Skidmap has the ability to set SELinux to permissive mode. ;; SslMM identifies and kills anti-malware processes. ;; StrongPity can add directories used by the malware to the Windows Defender exclusions list to prevent detection. ;; SUNBURST attempted to disable software security services following checks against a FNV-1a + XOR hashed hardcoded blocklist. ;; ThiefQuest uses the function kill_unwanted to obtain a list of running processes and kills each process matching a list of security related processes. ;; TinyZBot can disable Avira anti-virus. ;; TrickBot can disable Windows Defender. ;; Turla has used a AMSI bypass which patches the in-memory amsi.dll in PowerShell scripts to bypass Windows antimalware products. ;; UNC2452 used the service control manager on a remote system to disable services associated with security monitoring products. ;; Unknown Logger has functionality to disable security tools including Kaspersky BitDefender and MalwareBytes. ;; Wizard Spider has shut down or uninstalled security applications on victim systems that might prevent ransomware from executing. ;; ZxShell can kill AV products' processes. "
name: Impair Defenses: Disable Or Modify Tools