Disabling Security Tools

Jump to: navigation, search
Disabling Security Tools
ID T1089
Tactic Defense Evasion
Platform Windows Server 2003, Windows Server 2008, Windows Server 2012, Windows XP, Windows 7, Windows 8, Windows Server 2003 R2, Windows Server 2008 R2, Windows Server 2012 R2, Windows Vista, Windows 8.1
Data Sources API monitoring, Anti-virus, File monitoring, Services, Windows Registry, Process command-line parameters
Defense Bypassed Anti-virus, File monitoring, Host intrusion prevention systems, Signature-based detection, File monitoring, Log analysis

Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security scanning or event reporting.


  • Carbanak may use netsh to add local firewall rule exceptions.1
  • Malware used by Putter Panda attempts to terminate processes corresponding to two components of Sophos Anti-Virus (SAVAdminService.exe and SavService.exe).2
  • Various Lazarus Group malware modifies the Windows firewall to allow incoming connections or disable it entirely using netsh. 3 4 Lazarus Group malware TangoDelta attempts to terminate various processes associated with McAfee.4
  • TinyZBot can disable Avira anti-virus.5
  • The "ZR" variant of BACKSPACE will check to see if known host-based firewalls are installed on the infected systems. BACKSPACE will attempt to establish a C2 channel, then will examine open windows to identify a pop-up from the firewall software and will simulate a mouse-click to allow the connection to proceed.6
  • SslMM identifies and kills anti-malware processes.7
  • HDoor kills anti-virus found on the victim.7
  • Kasidet has the ability to change firewall settings to allow a plug-in to be downloaded.8
  • netsh can be used to disable local firewall settings.9
  • Remsec can add or remove applications or ports on the Windows firewall or disable it entirely.10
  • Unknown Logger has functionality to disable security tools, including Kaspersky, BitDefender, and MalwareBytes.11
  • H1N1 kills and disables services for Windows Firewall, Windows Security Center, and Windows Defender.12


Ensure proper process, registry, and file permissions are in place to prevent adversaries from disabling or interfering with security services.


Monitor processes and command-line arguments to see if security tools are killed or stop running. Monitor Registry edits for modifications to services and startup programs that correspond to security tools. Lack of log or event file reporting may be suspicious.