[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1562-001":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"mitre-attack","t1562-001","T1562.001","Disable or Modify Tools",32,"MITRE","**What attackers do.** Attackers turn off, uninstall or reconfigure security tools such as antivirus, endpoint detection agents and logging services so their later actions go unnoticed. This sub-technique serves the Defence Evasion tactic and is a common step before ransomware.\n\n**How to defend.** Enable tamper protection on security products, restrict who can change their configuration, and manage them centrally. Alert when an agent stops reporting, and treat that as a possible incident rather than an IT ticket. Block known vulnerable drivers that attackers use to kill security processes.\n\n**Signs to look for.** Watch for security services being stopped or uninstalled, exclusions being added, policy changes outside change windows, and endpoints that go silent. The main gap is a silent sensor: if nobody alerts on missing telemetry, disabling the tool looks the same as a healthy quiet host.",null,"https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1562\u002F001\u002F","Open the technique on MITRE ATT&CK","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},34,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"exposed-camera-software-exploited-to-mine-cryptocurrency-across-13-organizations","Exposed Camera Software Exploited to Mine Cryptocurrency Across 13 Organizations","2026-11-13T21:21:00.22+00:00",{"slug":24,"title":25,"published_at":26},"cruciferra-maas-crypter-hides-infostealers-and-rats-from-security-tools-at-scale","Cruciferra MaaS Crypter Hides Infostealers and RATs from Security Tools at Scale","2026-11-12T13:20:21.227+00:00",{"slug":28,"title":29,"published_at":30},"bigdiskbuster-silently-blocks-defender-updates-while-appearing-healthy","BigDiskBuster Silently Blocks Defender Updates While Appearing Healthy","2026-10-06T18:20:41.392+00:00",{"slug":32,"title":33,"published_at":34},"lunex-stealer-exploits-vulnerable-amd-driver-to-blind-security-tools-and-harvest-credentials","Lunex Stealer Exploits Vulnerable AMD Driver to Blind Security Tools and Harvest Credentials","2026-09-26T20:20:53.807+00:00",{"slug":36,"title":37,"published_at":38},"process-parameter-poisoning-bypasses-edr-detection","Process Parameter Poisoning Bypasses EDR Detection","2026-09-23T22:20:42.313+00:00",{"slug":40,"title":41,"published_at":42},"fake-lastpass-installer-uses-microsoft-signed-driver-to-blind-security-tools","Fake LastPass Installer Uses Microsoft-Signed Driver to Blind Security Tools","2026-09-21T20:20:50.032+00:00",{"slug":44,"title":45,"published_at":46},"fake-lastpass-github-repos-spread-rapuncel-infostealer-via-seo-poisoning","Fake LastPass GitHub Repos Spread Rapuncel Infostealer via SEO Poisoning","2026-09-18T16:21:01.897+00:00",{"slug":48,"title":49,"published_at":50},"iran-linked-handala-backdoor-uses-telegram-c2-and-defender-evasion-to-steal-credentials","Iran-Linked Handala Backdoor Uses Telegram C2 and Defender Evasion to Steal Credentials","2026-09-18T04:21:18.568+00:00",{"slug":52,"title":53,"published_at":54},"zero-day-shieldcrash-exploit-targets-windows-defender","Zero-Day 'ShieldCrash' Exploit Targets Windows Defender","2026-09-10T16:20:58.212+00:00",{"slug":56,"title":57,"published_at":58},"linux-rootkit-exploits-unpatched-f5-big-ip-apm-flaw-to-achieve-fileless-persistence","Linux Rootkit Exploits Unpatched F5 BIG-IP APM Flaw to Achieve Fileless Persistence","2026-09-08T22:22:35.275+00:00",{"slug":60,"title":61,"published_at":62},"revstealer-modules-disable-windows-defender-and-update-to-deploy-crypto-miner","REVSTEALER Modules Disable Windows Defender and Update to Deploy Crypto Miner","2026-09-06T10:20:38.502+00:00",{"slug":64,"title":65,"published_at":66},"fake-installers-sabotage-windows-update-and-defender-to-persist-undetected","Fake Installers Sabotage Windows Update and Defender to Persist Undetected","2026-09-02T18:20:49.991+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",33,{"slug":74,"name":75,"problem":76,"stories":77},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",15,{"slug":79,"name":80,"problem":81,"stories":82},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",12,{"slug":84,"name":85,"problem":86,"stories":87},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",7,{"slug":89,"name":90,"problem":91,"stories":92},"patch-management","Automated patch management","Known holes get closed in days, not months.",6,{"slug":94,"name":95,"problem":96,"stories":97},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",5,[99,105,111,116,121,126,131,136],{"family":100,"item":101,"code":102,"title":103,"together":104},"nist-800-53","si-3","SI-3","Malicious Code Protection",27,{"family":106,"item":107,"code":108,"title":109,"together":110},"cis","10","Control 10","Malware Defenses",25,{"family":106,"item":112,"code":113,"title":114,"together":115},"7","Control 7","Continuous Vulnerability Management",17,{"family":106,"item":117,"code":118,"title":119,"together":120},"13","Control 13","Network Monitoring and Defense",16,{"family":100,"item":122,"code":123,"title":124,"together":125},"cm-7","CM-7","Least Functionality",14,{"family":106,"item":127,"code":128,"title":129,"together":130},"2","Control 2","Inventory and Control of Software Assets",13,{"family":132,"item":133,"code":134,"title":135,"together":82},"gdpr","32","Article 32","Security of processing",{"family":137,"item":138,"code":139,"title":140,"together":82},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring"]