Defense evasion via security tool tampering is the final preparation step before most ransomware deployments and advanced persistent threat (APT) lateral movements. Attackers disable Microsoft Defender, inject AV exclusion paths, stop the MDE sensor service, or patch Event Tracing for Windows (ETW) to blind the SOC before executing destructive payloads. This SOP treats any confirmed security tool disable or AV exclusion injection as a SEV1 precursor event requiring immediate isolation — because the attack payload execution is almost certainly imminent.
Key data sources: DeviceProcessEvents (sc.exe, powershell.exe Set-MpPreference), DeviceRegistryEvents (Defender Exclusions registry keys), DeviceEvents (Tamper Protection disable alerts from MDE sensor).
☰ Table of Contents
01 — BACKGROUND
TECHNIQUE OVERVIEWDefense evasion via security tool impairment (T1562) is consistently observed in the pre-encryption phase of ransomware attacks and in APT lateral movement campaigns. Attackers disable or modify security tools to prevent detection of their subsequent actions — payload execution, credential dumping, and data exfiltration. This is the "lights-out" step before the main attack.
| Field | Value |
|---|---|
| MITRE Technique | T1562.001 — Impair Defenses: Disable or Modify Tools T1562.006 — Impair Defenses: Indicator Blocking (ETW patching) |
| Kill-chain Phase | Defense Evasion (pre-execution) |
| Primary Log Source | DeviceProcessEvents, DeviceRegistryEvents, DeviceEvents (MDE) |
| Secondary Log Sources | SecurityEvent 4703 (privilege use), WindowsEvent 7035 (service stopped) |
| Common Tooling | sc.exe, net.exe stop, powershell.exe (Set-MpPreference, Add-MpPreference), reg.exe, mpcmdrun.exe |
| Default Severity | SEV1 precursor — treat as active attack in progress |
| Detection Window | Query last 1 hour minimum; extend to 24 hours for hunting |
Security tool disablement immediately preceding payload execution is the most reliable precursor indicator for ransomware. Any confirmed Defender disable without a change-ticket MUST be treated as SEV1 — assume payload is seconds to minutes away.
02 — IDENTIFICATION
2 INDICATORSAttackers stop or delete the WinDefend / MsSense service and disable real-time protection immediately before payload execution. This event has virtually no legitimate administrative use outside a documented change window — any unticket occurrence is a confirmed attack precursor.
- 1In the left sidebar click Hunting, then Advanced Hunting.
- 2Paste the KQL query below into the query editor.
- 3Set Time range to Last 1 hour (expand to 24h for hunting).
- 4Click Run query. For any result, click the row and open the Device Timeline from the DeviceName link to see the full execution chain.
- 5Navigate to Incidents & alerts → Alerts and filter by Microsoft Defender Antivirus to check for co-incident Tamper Protection alerts.
| Command / Indicator | Meaning | Severity |
|---|---|---|
| sc stop WinDefend | Stops Windows Defender service — real-time protection halted | CRITICAL |
| sc delete WinDefend | Deletes Defender service entry — requires re-install to restore | CRITICAL |
| sc stop MsSense | Stops Microsoft Defender for Endpoint sensor — telemetry blackout | CRITICAL |
| Set-MpPreference -DisableRealtimeMonitoring $true | Disables real-time protection via PowerShell | CRITICAL |
| Set-MpPreference -DisableAntiSpyware $true | Disables antispyware engine component | CRITICAL |
| Set-MpPreference -DisableBehaviorMonitoring $true | Disables behavioral monitoring (blocks AMSI/heuristics) | HIGH |
| netsh advfirewall set allprofiles state off | Disables Windows Firewall on all profiles | HIGH |
| bcdedit /set {default} recoveryenabled No | Disables Windows Recovery — ransomware pre-step | HIGH |
| vssadmin delete shadows /all | Deletes all Volume Shadow Copies — ransomware recovery prevention | CRITICAL |
Adding AV exclusion paths via registry or PowerShell allows attackers to drop and execute payloads in a "blind spot" that Defender will not scan. ETW patching (modifying NtTraceControl or EtwpNotificationThread in ntdll.dll) prevents Event Tracing events from reaching the SIEM. Both are highly targeted evasion techniques used in hands-on-keyboard intrusions.
- 1Open Advanced Hunting and run the DeviceRegistryEvents query below targeting Defender Exclusions registry paths.
- 2For any hit, check InitiatingProcessFileName and InitiatingProcessCommandLine to determine whether the change came from a known admin tool or an unexpected process.
- 3Cross-reference with I1 — an exclusion addition immediately followed by a Defender disable is a confirmed attack chain.
- 4For ETW patching: check DeviceEvents for NtTraceControl or EtwEventWrite memory write events from unexpected processes (rare in default MDE telemetry; requires enhanced coverage).
- 5Check Add-MpPreference in PowerShell command lines — this is the most common exclusion injection method in ransomware pre-attack scripts.
| Registry Path / Command | Meaning | Severity |
|---|---|---|
| SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths | Exclusion path added — files in this path skip AV scanning | CRITICAL |
| SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions | File extension excluded — e.g. .exe, .dll bypasses scanning | CRITICAL |
| Add-MpPreference -ExclusionPath | PowerShell exclusion injection — common ransomware dropper technique | CRITICAL |
| SOFTWARE\Policies\Microsoft\Windows Defender | Group Policy Defender settings modified — can disable entire AV via policy | HIGH |
| MpCmdRun.exe -RemoveDefinitions -All | Removes all Defender signature definitions | HIGH |
| ETW NtTraceControl patch | In-memory patch to disable ETW telemetry — advanced actor technique | CRITICAL |
ETW patching is rare but devastating — it prevents Sysmon, MDE, and most EDRs from recording events. If a process with no known hash performs NtWriteVirtualMemory into ntdll.dll address space, escalate immediately. Enhanced MDE telemetry (device isolation + live response) is required to confirm ETW patching in-flight.
03 — CONTAINMENT
IMMEDIATE ACTIONNever accept "it was an admin" without a change ticket. Threat actors frequently use stolen admin credentials to disable defenses. Verify the change ticket references this specific device, this specific change, within this time window.
- 1Navigate to the affected device in Assets → Devices. Click the device name.
- 2Click Actions (⋮) in the top-right and select Isolate Device. Choose Full Isolation.
- 3Before isolation: initiate a Live Response session (Actions → Initiate Live Response) and collect a memory image and running process list — volatile evidence will be lost after network isolation.
- 4After isolation is confirmed (device status changes to "Isolated"), navigate back to Incidents & alerts and link all related alerts to a new incident.
- 5Check all other devices in the same subnet via Advanced Hunting — confirm whether the disable command was executed on multiple endpoints simultaneously (indicates automated ransomware propagation).
- 1Via MDE Live Response or on a physically accessed device, restart Defender:
sc start WinDefendandsc start MsSense. - 2Remove injected exclusions: run
Remove-MpPreference -ExclusionPath <path>or delete the registry key underHKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths. - 3Enable Tamper Protection via MDE portal: Settings → Endpoints → Advanced features → Tamper Protection → On. This prevents future service stops without MDE authorization.
- 4If vssadmin delete shadows was executed, check if shadow copies still exist on other hosts — ransomware may not have fully propagated yet. Act immediately to snapshot remaining systems.
- 5Block the initiating process path or hash via MDE indicator: Settings → Endpoints → Indicators → File → Add indicator.
If VSS deletion was confirmed, assume encryption may already be in progress on some files. Treat this as a ransomware incident (SOP-03) in parallel with this SOP.
04 — ERADICATION
CLEANUP- 1Identify the initiating process chain from I1/I2. Trace back to the initial access point — phishing email, RDP session, or lateral movement from another compromised host.
- 2Search for scheduled tasks, registry run keys, or WMI subscriptions created by the same account or process around the same time (cross-reference SOP-26 and SOP-30).
- 3Run a full Defender scan on the isolated endpoint after re-enabling protection:
Start-MpScan -ScanType FullScanvia Live Response. - 4If VSS deletion was confirmed, recover from a known-good backup from before the intrusion timeline — do not trust any files on the affected system.
- 5Audit all accounts that authenticated to the affected device in the 48 hours prior: check for credential compromise and force password resets on any interactive session accounts.
- 6Verify Tamper Protection is enforced via Intune/MDE policy — ensure no policy allows local override of Tamper Protection settings.
05 — ESCALATION
ESCALATION PATHS| Condition | Severity | Action | Notify |
|---|---|---|---|
| Defender stopped / MDE sensor killed | SEV1 | Isolate immediately, open war room | SOC Lead → CISO → IR Team |
| VSS deletion confirmed | SEV1 | Treat as active ransomware — escalate to SOP-03 | SOC Lead → CISO → CEO |
| AV exclusion added, no service stop | SEV2 | Isolate within 15 min, verify change ticket | SOC Lead → Security Manager |
| Firewall disabled only | SEV2 | Re-enable firewall, investigate initiating process | SOC Lead → Security Manager |
| bcdedit recoveryenabled No | SEV2 | Assume ransomware staging, treat as SEV1 if Defender also disabled | SOC Lead |
| Admin task with valid change ticket | FP | Close, document, tune detection rule | L3 Analyst log only |
If Defender is disabled AND VSS is deleted — this is a live ransomware deployment. Immediately escalate to SOP-03, notify CISO and CEO, and initiate business continuity procedures. Do not wait for confirmation of encrypted files.
Stay Threat-Ready
Follow CyberHawk Threat Intel for daily SOC analyst playbooks, detection engineering guides, and threat intelligence.