T1685
Disable or Modify Tools
Index entry
In-depth coverage of this technique (how it looks in telemetry, how to hunt it, and how to rule out benign activity) is coming soon. It's in our catalog and on the roadmap to be written up.
Telemetry needed
The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.
- AWS CloudTrail (the log as a whole)
- ESXi and vCenter logs (the log as a whole)
- Kubernetes API server audit log (the log as a whole)
- Linux audit framework (auditd) (the log as a whole)
- macOS unified log (the log as a whole)
- Network device logs (syslog, CLI/AAA, config, SNMP) (the log as a whole)
- Sysmon
- Windows System event log
- 7045 New Windows Service
Practice it
2 scenarios in this catalog cover T1685. We don't name them, because identifying the technique is part of what a scenario grades. Explore the Range →