Impair Defenses

What is Impair Defenses?

“Impair Defenses is documented as technique T1562 in MITRE ATT&CK® v19.1 under the Defense Evasion tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Impair Defenses activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor Windows Defender configuration changes including real-time protection disabling, exclusion additions, and scan schedule modifications, alerting on changes made outside of authorized IT administration processes.

2. 2

   Alert on processes terminating security tool processes including antivirus, EDR agents, and SIEM forwarders, particularly when the termination is performed using taskkill, process API calls, or by stopping associated services.

3. 3

   Detect Windows Firewall rule modifications adding inbound allow rules or disabling the firewall entirely, as attackers frequently modify firewall configurations to allow their tools to communicate or to enable lateral movement.

4. 4

   Monitor for registry modifications that disable security features including Windows Event Log forwarding, PowerShell ScriptBlock logging, and Protected Users security settings that limit credential caching.

5. 5

   Implement out-of-band health monitoring for security tools that alerts on agents going offline unexpectedly, as agent silence may indicate successful defense impairment even when the impairment action itself was not directly observed.

Example Alerts

These realistic alert examples show what Impair Defenses looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Impair Defenses?

Detection centers on XDR, SIEM telemetry for the defense evasion phase of the attack. Monitor Windows Defender configuration changes including real-time protection disabling, exclusion additions, and scan schedule modifications, alerting on changes made outside of authorized IT administration processes. Alert on processes terminating security tool processes including antivirus, EDR agents, and SIEM forwarders, particularly when the termination is performed using taskkill, process API calls, or by stopping associated services.

What does a Impair Defenses alert look like?

A representative XDR detection is "Windows Defender Disabled via PowerShell" (critical severity): PowerShell command Set-MpPreference -DisableRealtimeMonitoring $true executed on 12 workstations within a 3-minute window. Simultaneous disabling of real-time protection across multiple systems is characteristic of pre-ransomware preparation scripts run from a compromised administrator account. Following the disablement, network traffic from these workstations shows connections to known ransomware distribution infrastructure.

Which tools detect Impair Defenses, and how can I practice?

Impair Defenses (T1562) is best surfaced with XDR, SIEM telemetry, which exposes the defense evasion signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.