Disabling Security Tools
|Disabling Security Tools|
|Platform||Linux, macOS, Windows|
|Data Sources||API monitoring, Anti-virus, File monitoring, Services, Windows Registry, Process command-line parameters|
|Defense Bypassed||Anti-virus, File monitoring, Host intrusion prevention systems, Signature-based detection, File monitoring, Log analysis|
Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security scanning or event reporting.
- Carbanak may use netsh to add local firewall rule exceptions.1
- Dragonfly disabled the host-based firewall on a victim and globally opened port 3389.2
- Various Lazarus Group malware modifies the Windows firewall to allow incoming connections or disable it entirely using netsh. 3 4 Lazarus Group malware TangoDelta attempts to terminate various processes associated with McAfee.4
- Malware used by Putter Panda attempts to terminate processes corresponding to two components of Sophos Anti-Virus (SAVAdminService.exe and SavService.exe).5
- Threat Group-3390 has used appcmd.exe to disable logging on a victim server.6
- The "ZR" variant of BACKSPACE will check to see if known host-based firewalls are installed on the infected systems. BACKSPACE will attempt to establish a C2 channel, then will examine open windows to identify a pop-up from the firewall software and will simulate a mouse-click to allow the connection to proceed.7
- ChChes can alter the victim's proxy configuration.8
- H1N1 kills and disables services for Windows Firewall, Windows Security Center, and Windows Defender.9
- HDoor kills anti-virus found on the victim.10
- JPIN lower disable security settings by changing Registry keys.11
- Kasidet has the ability to change firewall settings to allow a plug-in to be downloaded.12
- NanHaiShu can change Internet Explorer settings to reduce warnings about malware activity.13
- POWERSTATS can disable Microsoft Office Protected View by changing Registry keys.14
- Remsec can add or remove applications or ports on the Windows firewall or disable it entirely.15
- SslMM identifies and kills anti-malware processes.10
- TinyZBot can disable Avira anti-virus.16
- Unknown Logger has functionality to disable security tools, including Kaspersky, BitDefender, and MalwareBytes.17
- netsh can be used to disable local firewall settings.18
Ensure proper process, registry, and file permissions are in place to prevent adversaries from disabling or interfering with security services.
Monitor processes and command-line arguments to see if security tools are killed or stop running. Monitor Registry edits for modifications to services and startup programs that correspond to security tools. Lack of log or event file reporting may be suspicious.
- Group-IB and Fox-IT. (2014, December). Anunak: APT against financial institutions. Retrieved April 20, 2016.
- US-CERT. (2017, October 20). Alert (TA17-293A): Advanced Persistent Threat Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved November 2, 2017.
- Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Loaders, Installers and Uninstallers Report. Retrieved March 2, 2016.
- Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Tools Report. Retrieved March 10, 2016.
- Crowdstrike Global Intelligence Team. (2014, June 9). CrowdStrike Intelligence Report: Putter Panda. Retrieved January 22, 2016.
- Counter Threat Unit Research Team. (2017, June 27). BRONZE UNION Cyberespionage Persists Despite Disclosures. Retrieved July 13, 2017.
- FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved May 1, 2015.
- PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.
- Reynolds, J.. (2016, September 14). H1N1: Technical analysis reveals new capabilities – part 2. Retrieved September 26, 2016.
- Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved December 17, 2015.
- Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
- Yadav, A., et al. (2016, January 29). Malicious Office files dropping Kasidet and Dridex. Retrieved March 24, 2016.
- Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.
- Singh, S. et al.. (2018, March 13). Iranian Threat Group Updates Tactics, Techniques and Procedures in Spear Phishing Campaign. Retrieved April 11, 2018.
- Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.
- Cylance. (2014, December). Operation Cleaver. Retrieved September 14, 2017.
- Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016.
- Microsoft. (2009, June 3). Netsh Commands for Windows Firewall. Retrieved April 20, 2016.