// MITRE ATT&CK
T1685 · Disable or Modify Tools
Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specifi...
How to detect & mitigate it
Detecting Disable or Modify Tools starts with your SIEM/EDR telemetry. Write a detection rule with the Sigma generator, analyze suspicious logs in the log analyzer, and place the technique on your coverage with the ATT&CK matrix.
Sub-techniques (6)
T1685.001
Disable or Modify Windows Event Log T1685.002
Disable or Modify Cloud Log T1685.003
Modify or Spoof Tool UI T1685.004
Disable or Modify Linux Audit System Log T1685.005
Clear Windows Event Logs T1685.006
Clear Linux or Mac System Logs
Disable or Modify Windows Event Log T1685.002
Disable or Modify Cloud Log T1685.003
Modify or Spoof Tool UI T1685.004
Disable or Modify Linux Audit System Log T1685.005
Clear Windows Event Logs T1685.006
Clear Linux or Mac System Logs
Related techniques
T1687
Exploitation for Defense Impairment T1556.003
Pluggable Authentication Modules T1578.004
Revert Cloud Instance T1222.002
Linux and Mac Permissions T1666
Modify Cloud Resource Hierarchy T1685.003
Modify or Spoof Tool UI T1685.001
Disable or Modify Windows Event Log T1578
Modify Cloud Compute Infrastructure
Exploitation for Defense Impairment T1556.003
Pluggable Authentication Modules T1578.004
Revert Cloud Instance T1222.002
Linux and Mac Permissions T1666
Modify Cloud Resource Hierarchy T1685.003
Modify or Spoof Tool UI T1685.001
Disable or Modify Windows Event Log T1578
Modify Cloud Compute Infrastructure
Source: MITRE ATT&CK®. ATT&CK is a registered trademark of The MITRE Corporation. Content for educational purposes.