[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1562-001":3},{"item":4,"lessons":16,"controls":66,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"mitre-attack","t1562-001","T1562.001","Disable or Modify Tools",32,"MITRE","**What attackers do.** Attackers turn off, uninstall or reconfigure security tools such as antivirus, endpoint detection agents and logging services so their later actions go unnoticed. This sub-technique serves the Defence Evasion tactic and is a common step before ransomware.\n\n**How to defend.** Enable tamper protection on security products, restrict who can change their configuration, and manage them centrally. Alert when an agent stops reporting, and treat that as a possible incident rather than an IT ticket. Block known vulnerable drivers that attackers use to kill security processes.\n\n**Signs to look for.** Watch for security services being stopped or uninstalled, exclusions being added, policy changes outside change windows, and endpoints that go silent. The main gap is a silent sensor: if nobody alerts on missing telemetry, disabling the tool looks the same as a healthy quiet host.",null,"https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1562\u002F001\u002F","Open the technique on MITRE ATT&CK","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"bigdiskbuster-silently-blocks-defender-updates-while-appearing-healthy","BigDiskBuster Silently Blocks Defender Updates While Appearing Healthy","2026-10-06T18:20:41.392+00:00",{"slug":23,"title":24,"published_at":25},"lunex-stealer-exploits-vulnerable-amd-driver-to-blind-security-tools-and-harvest-credentials","Lunex Stealer Exploits Vulnerable AMD Driver to Blind Security Tools and Harvest Credentials","2026-09-26T20:20:53.807+00:00",{"slug":27,"title":28,"published_at":29},"process-parameter-poisoning-bypasses-edr-detection","Process Parameter Poisoning Bypasses EDR Detection","2026-09-23T22:20:42.313+00:00",{"slug":31,"title":32,"published_at":33},"fake-lastpass-installer-uses-microsoft-signed-driver-to-blind-security-tools","Fake LastPass Installer Uses Microsoft-Signed Driver to Blind Security Tools","2026-09-21T20:20:50.032+00:00",{"slug":35,"title":36,"published_at":37},"fake-lastpass-github-repos-spread-rapuncel-infostealer-via-seo-poisoning","Fake LastPass GitHub Repos Spread Rapuncel Infostealer via SEO Poisoning","2026-09-18T16:21:01.897+00:00",{"slug":39,"title":40,"published_at":41},"iran-linked-handala-backdoor-uses-telegram-c2-and-defender-evasion-to-steal-credentials","Iran-Linked Handala Backdoor Uses Telegram C2 and Defender Evasion to Steal Credentials","2026-09-18T04:21:18.568+00:00",{"slug":43,"title":44,"published_at":45},"zero-day-shieldcrash-exploit-targets-windows-defender","Zero-Day 'ShieldCrash' Exploit Targets Windows Defender","2026-09-10T16:20:58.212+00:00",{"slug":47,"title":48,"published_at":49},"linux-rootkit-exploits-unpatched-f5-big-ip-apm-flaw-to-achieve-fileless-persistence","Linux Rootkit Exploits Unpatched F5 BIG-IP APM Flaw to Achieve Fileless Persistence","2026-09-08T22:22:35.275+00:00",{"slug":51,"title":52,"published_at":53},"revstealer-modules-disable-windows-defender-and-update-to-deploy-crypto-miner","REVSTEALER Modules Disable Windows Defender and Update to Deploy Crypto Miner","2026-09-06T10:20:38.502+00:00",{"slug":55,"title":56,"published_at":57},"fake-installers-sabotage-windows-update-and-defender-to-persist-undetected","Fake Installers Sabotage Windows Update and Defender to Persist Undetected","2026-09-02T18:20:49.991+00:00",{"slug":59,"title":60,"published_at":61},"signed-adware-used-as-trojan-horse-to-deliver-valleyrat-backdoor","Signed Adware Used as Trojan Horse to Deliver ValleyRAT Backdoor","2026-08-31T14:21:35.438+00:00",{"slug":63,"title":64,"published_at":65},"valleyrat-backdoor-hidden-inside-fake-adware-installer","ValleyRAT Backdoor Hidden Inside Fake Adware Installer","2026-08-31T12:21:08.906+00:00",[67,72,77,82,87,91],{"slug":68,"name":69,"problem":70,"stories":71},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",31,{"slug":73,"name":74,"problem":75,"stories":76},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",15,{"slug":78,"name":79,"problem":80,"stories":81},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",11,{"slug":83,"name":84,"problem":85,"stories":86},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",6,{"slug":88,"name":89,"problem":90,"stories":86},"patch-management","Automated patch management","Known holes get closed in days, not months.",{"slug":92,"name":93,"problem":94,"stories":95},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",5,[97,103,109,114,118,123,128,134],{"family":98,"item":99,"code":100,"title":101,"together":102},"nist-800-53","si-3","SI-3","Malicious Code Protection",26,{"family":104,"item":105,"code":106,"title":107,"together":108},"cis","10","Control 10","Malware Defenses",24,{"family":104,"item":110,"code":111,"title":112,"together":113},"7","Control 7","Continuous Vulnerability Management",16,{"family":104,"item":115,"code":116,"title":117,"together":113},"13","Control 13","Network Monitoring and Defense",{"family":98,"item":119,"code":120,"title":121,"together":122},"cm-7","CM-7","Least Functionality",14,{"family":104,"item":124,"code":125,"title":126,"together":127},"2","Control 2","Inventory and Control of Software Assets",13,{"family":129,"item":130,"code":131,"title":132,"together":133},"gdpr","32","Article 32","Security of processing",12,{"family":135,"item":136,"code":137,"title":138,"together":133},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring"]