Disable or Modify Tools `T1685`

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.

Events covered

42 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 7	Image loaded
Sysmon	Event ID 10	ProcessAccess
Sysmon	Event ID 11	FileCreate
Sysmon	Event ID 12	RegistryEvent (Object create and delete)
Sysmon	Event ID 13	RegistryEvent (Value Set)
Sysmon	Event ID 14	RegistryEvent (Key and Value Rename)
Sysmon	Event ID 17	PipeEvent (Pipe Created)
Sysmon	Event ID 18	PipeEvent (Pipe Connected)
Security-Auditing	Event ID 4656	A handle to an object was requested.
Security-Auditing	Event ID 4657	A registry value was modified.
Security-Auditing	Event ID 4663	An attempt was made to access an object.
Security-Auditing	Event ID 4673	A privileged service was called.
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4719	System audit policy was changed.
Security-Auditing	Event ID 4720	A user account was created.
Security-Auditing	Event ID 4738	A user account was changed.
Security-Auditing	Event ID 5136	A directory service object was modified.
Security-Auditing	Event ID 5157	The Windows Filtering Platform has blocked a connection.
Security-Auditing	Event ID 5441	The following filter was present when the Windows Filtering Platform Base Filtering Engine started.
Security-Auditing	Event ID 5447	A Windows Filtering Platform filter has been changed.
Application-Error	Event ID 1000	Faulting application name: Faulting_application_name, version: version, time stamp: 0xFaulting_module_name.
Application-Popup	Event ID 26	Application popup: Caption : Message.
Eventlog	Event ID 104	The LogFileCleared.Channel log file was cleared.
Eventlog	Event ID 1100	The event logging service has shut down.
Eventlog	Event ID 1102	The audit log was cleared.
IIS-Configuration	Event ID 29	Changes to 'Configuration' at 'ConfigPath' have successfully been committed.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).
Windows-Defender	Event ID 1009	ProductName has restored an item from quarantine.
Windows-Defender	Event ID 1119	ProductName has encountered a critical error when taking action on malware or other potentially unwanted software.
Windows-Defender	Event ID 3002	ProductName Real-Time Protection feature has encountered an error and failed.
Windows-Defender	Event ID 3007	ProductName Real-time Protection feature has restarted.
Windows-Defender	Event ID 5001	Product Name Real-time Protection scanning for malware and other potentially unwanted software was disabled.
Windows-Defender	Event ID 5007	Product Name Configuration has changed.
Windows-Defender	Event ID 5010	ProductName scanning for spyware and other potentially unwanted software is disabled.
Windows-Defender	Event ID 5012	ProductName scanning for viruses is disabled.
Windows-Defender	Event ID 5013	Tamper Protection Changed Type a change to Product Name.
Windows-Defender	Event ID 5101	{Product Name} grace period has expired.
PowerShell	Event ID 600	Event ID 600
Service-Control-Manager	Event ID 7036	The Microsoft Software Shadow Copy Provider service entered the stopped state.
Service-Control-Manager	Event ID 7040	The start type of the msdsm service was changed from boot start to demand start.
Windows-Error-Reporting	Event ID 1001	Fault bucket , type.

Authoring guide

Patterns shared across the 274 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (62 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Field	Rules	How	Sample values
`CommandLine`	92	`contains` 85, `in` 14, `ends_with` 3, `match` 3	`add` , `add` , `delete` , `/set`, `delete`
`Details`	91	`eq` 74, `is_not_null` 23, `contains` 11, `in` 4, `ends_with` 1	`0x00000000`, `0x00000001`, `DWORD (0x00000000)`, `DWORD (0x00000001)`, `0`
`Image`	63	`ends_with` 58, `contains` 8, `starts_with` 7, `eq` 5, `is_null` 1	`\powershell.exe`, `\pwsh.exe`, `\reg.exe`, `\powershell_ise.exe`, `:\perflogs\`
`registry_path`	56	`ends_with` 34, `contains` 20, `in` 3	`\\microsoft\\windows defender\\spynet`, `\\policies\\microsoft\\windows defender`, `SecurityHealthService`, `WdBoot`, `WdFilter`
`OriginalFileName`	51	`eq` 51	`powershell.exe`, `pwsh.dll`, `reg.exe`, `auditpol.exe`, `powershell_ise.exe`
`TargetObject`	46	`contains` 26, `ends_with` 26, `eq` 4	`\software\microsoft\windows...`, `\control\keyboard layouts\`, `\deviceguard\enablevirtualizationbasedsecurity`, `\deviceguard\lsacfgflags`, `\microsoft\windows\currentversion\winevt\channels\`
`process_name`	32	`eq` 31, `ends_with` 2, `starts_with` 1	`auditpol.exe`, `sfc.exe`, `wevtutil.exe`, `powershell.exe`, `powershell_ise.exe`
`EventID`	17	`eq` 15, `in` 2	`4104`, `4719`, `5136`, `7040`, `10`
`registry_value_name`	17	`eq` 15, `in` 2	`DisableAntiSpyware`, `Start`, `COMPlus_ETWEnabled`, `ChannelAccess`, `CustomSD`
`ScriptBlockText`	13	`contains` 12, `match` 2, `in` 1	`-exclusionextension` , `-exclusionipaddress` , `-exclusionpath` , `-xmlpolicy` , `#<null>`
`Channel`	12	`eq` 12, `in` 10
`eventtype`	10	`eq` 10
`Provider_Name`	7	`eq` 7	`Microsoft-Windows-Eventlog`, `Application Error`, `Application Popup`, `Security`, `Service Control Manager`
`EventType`	6	`eq` 6	`deleted`, `CreateKey`, `DeleteValue`, `modified`
`CallTrace`	5	`contains` 3, `eq` 1, `regex_match` 1	`Ente`, `\dbgcore.dll`, `\dbghelp.dll`, `^C:\\Windows\\SYSTEM32\\ntdll\.dll\+[a-z0-9]{4,6}\\|C:\\Wi...`, `dbgcore.dll`

Top indicator values (1705 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Field	Kind	Value	Rules (here)	Corpus reach
`Details`	`eq`	`0x00000000` splunkDisable AMSI Through Registry splunkDisable Defender MpEngine Registry splunkDisable Defender Spynet Reporting splunkDisable Defender Submit Samples Consent Feature splunkDisable ETW Through Registry splunkDisable Show Hidden Files splunkETW Registry Disabled splunkHide User Account From Sign-In Screen splunkWindows Impair Defense Configure App Install Control splunkWindows Impair Defense Disable Controlled Folder Access splunkWindows Impair Defense Disable PUA Protection splunkWindows Impair Defense Disable Realtime Signature Delivery splunkWindows Impair Defense Disable Web Evaluation splunkWindows Impair Defense Disable Win Defender App Guard splunkWindows Impair Defense Disable Win Defender Compute File Hashes splunkWindows Impair Defense Disable Win Defender Network Protection splunkWindows Impair Defense Overide Win Defender Phishing Filter splunkWindows Impair Defense Override SmartScreen Prompt splunkWindows Impair Defenses Disable Auto Logger Session splunkWindows Impair Defenses Disable HVCI splunkWindows Impair Defenses Disable Win Defender Auto Logging	21	43
`Details`	`eq`	`0x00000001` splunkDisable Defender AntiVirus Registry splunkDisable Defender BlockAtFirstSeen Feature splunkDisable Defender Enhanced Notification splunkDisable Registry Tool splunkDisable Show Hidden Files splunkDisable Windows Behavior Monitoring splunkDisabling CMD Application splunkDisabling ControlPanel splunkDisabling FolderOptions Windows Feature splunkDisabling NoRun Windows App splunkDisabling Task Manager splunkWindows DisableAntiSpyware Registry splunkWindows Impair Defense Change Win Defender Health Check Intervals splunkWindows Impair Defense Change Win Defender Tracing Level splunkWindows Impair Defense Disable Defender Firewall And Network splunkWindows Impair Defense Disable Defender Protocol Recognition splunkWindows Impair Defense Disable Win Defender Gen reports splunkWindows Impair Defense Disable Win Defender Report Infection splunkWindows Impair Defense Disable Win Defender Scan On Update splunkWindows Impair Defense Disable Win Defender Signature Retirement	20	63
`Details`	`eq`	`DWORD (0x00000000)` sigmaAMSI Disabled via Registry Modification sigmaAntivirus Filter Driver Disallowed On Dev Drive - Registry sigmaDisable Privacy Settings Experience in Registry sigmaDisable PUA Protection on Windows Defender sigmaDisable Tamper Protection on Windows Defender sigmaDisable Windows Defender Functionalities Via Registry Keys sigmaDisable Windows Event Logging Via Registry sigmaDisabled Windows Defender Eventlog sigmaETW Logging Disabled For rpcrt4.dll sigmaETW Logging Disabled In .NET Processes - Sysmon Registry sigmaHide Schedule Task Via Index Value Tamper sigmaMicrosoft Office Protected View Disabled sigmaNetNTLM Downgrade Attack - Registry sigmaPotential AutoLogger Sessions Tampering sigmaTamper With Sophos AV Registry Keys sigmaWindows Credential Guard Disabled - Registry sigmaWindows Hypervisor Enforced Code Integrity Disabled sigmaWindows Vulnerable Driver Blocklist Disabled	18	40
`Details`	`eq`	`DWORD (0x00000001)` sigmaDisable Windows Defender Functionalities Via Registry Keys sigmaEnable Remote Connection Between Anonymous Computer - AllowAnonymousCallback sigmaETW Logging Disabled For SCM sigmaHypervisor Enforced Paging Translation Disabled sigmaMicrosoft Office Protected View Disabled sigmaNetNTLM Downgrade Attack - Registry sigmaPython Function Execution Security Warning Disabled In Excel - Registry sigmaScripted Diagnostics Turn Off Check Enabled - Registry	8	42
`Image`	`ends_with`	`\powershell.exe` sigmaDisable Windows Defender AV Security Monitoring sigmaHypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine sigmaObfuscated PowerShell OneLiner Execution sigmaSecurity Event Logging Disabled via MiniNt Registry Key - Process sigmaService StartupType Change Via PowerShell Set-Service sigmaSuspicious Eventlog Clearing or Configuration Change Activity sigmaSuspicious Uninstall of Windows Defender Feature via PowerShell sigmaSuspicious Windows Service Tampering sigmaVulnerable Driver Blocklist Registry Tampering Via CommandLine sigmaWindows AMSI Related Registry Tampering Via CommandLine sigmaWindows Credential Guard Registry Tampering Via CommandLine sigmaWindows Defender Context Menu Removed sigmaWindows EventLog Autologger Session Registry Modification Via CommandLine sigmaWindows Firewall Disabled via PowerShell	14	186
`Image`	`ends_with`	`\pwsh.exe` sigmaDisable Windows Defender AV Security Monitoring sigmaHypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine sigmaSecurity Event Logging Disabled via MiniNt Registry Key - Process sigmaSuspicious Eventlog Clearing or Configuration Change Activity sigmaSuspicious Uninstall of Windows Defender Feature via PowerShell sigmaSuspicious Windows Service Tampering sigmaVulnerable Driver Blocklist Registry Tampering Via CommandLine sigmaWindows AMSI Related Registry Tampering Via CommandLine sigmaWindows Credential Guard Registry Tampering Via CommandLine sigmaWindows Defender Context Menu Removed sigmaWindows EventLog Autologger Session Registry Modification Via CommandLine sigmaWindows Firewall Disabled via PowerShell	12	172
`Image`	`ends_with`	`\reg.exe` sigmaAdd SafeBoot Keys Via Reg Utility sigmaDisabling Windows Defender WMI Autologger Session via Reg.exe sigmaHypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine sigmaReg Add Suspicious Paths sigmaSecurity Event Logging Disabled via MiniNt Registry Key - Process sigmaSuspicious Windows Defender Folder Exclusion Added Via Reg.EXE sigmaSuspicious Windows Defender Registry Key Tampering Via Reg.EXE sigmaVulnerable Driver Blocklist Registry Tampering Via CommandLine sigmaWindows AMSI Related Registry Tampering Via CommandLine sigmaWindows Credential Guard Registry Tampering Via CommandLine sigmaWindows Defender Context Menu Removed sigmaWindows EventLog Autologger Session Registry Modification Via CommandLine	12	60
`Image`	`ends_with`	`\powershell_ise.exe` sigmaSecurity Event Logging Disabled via MiniNt Registry Key - Process sigmaSuspicious Eventlog Clearing or Configuration Change Activity sigmaSuspicious Uninstall of Windows Defender Feature via PowerShell sigmaSuspicious Windows Service Tampering sigmaWindows Defender Context Menu Removed sigmaWindows Firewall Disabled via PowerShell	6	42
`Image`	`ends_with`	`\msmpeng.exe` sigmaDisable Tamper Protection on Windows Defender sigmaHackTool - SysmonEnte Execution sigmaPotential AutoLogger Sessions Tampering sigmaRemoval Of AMSI Provider Registry Keys sigmaWindows Filtering Platform Blocked Connection From EDR Agent Binary	5	18
`Image`	`ends_with`	`\wmic.exe` sigmaPotential Windows Defender Tampering Via Wmic.EXE sigmaService Startup Type Change Via Wmic.EXE sigmaSuspicious Eventlog Clearing or Configuration Change Activity sigmaSuspicious Windows Service Tampering	4	61
`OriginalFileName`	`eq`	`powershell.exe` sigmaDisable Windows Defender AV Security Monitoring sigmaHypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine sigmaSecurity Event Logging Disabled via MiniNt Registry Key - Process sigmaService StartupType Change Via PowerShell Set-Service sigmaSuspicious Uninstall of Windows Defender Feature via PowerShell sigmaSuspicious Windows Service Tampering sigmaVulnerable Driver Blocklist Registry Tampering Via CommandLine sigmaWindows AMSI Related Registry Tampering Via CommandLine sigmaWindows Credential Guard Registry Tampering Via CommandLine sigmaWindows Defender Context Menu Removed sigmaWindows EventLog Autologger Session Registry Modification Via CommandLine sigmaWindows Firewall Disabled via PowerShell splunkPowershell Disable Security Monitoring splunkWindows Impair Defense Add Xml Applocker Rules	14	121
`OriginalFileName`	`eq`	`pwsh.dll` sigmaDisable Windows Defender AV Security Monitoring sigmaHypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine sigmaSecurity Event Logging Disabled via MiniNt Registry Key - Process sigmaSuspicious Uninstall of Windows Defender Feature via PowerShell sigmaSuspicious Windows Service Tampering sigmaVulnerable Driver Blocklist Registry Tampering Via CommandLine sigmaWindows AMSI Related Registry Tampering Via CommandLine sigmaWindows Credential Guard Registry Tampering Via CommandLine sigmaWindows Defender Context Menu Removed sigmaWindows EventLog Autologger Session Registry Modification Via CommandLine sigmaWindows Firewall Disabled via PowerShell splunkPowershell Disable Security Monitoring splunkWindows Impair Defense Add Xml Applocker Rules	13	112
`OriginalFileName`	`eq`	`reg.exe` sigmaAdd SafeBoot Keys Via Reg Utility sigmaDisabling Windows Defender WMI Autologger Session via Reg.exe sigmaHypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine sigmaReg Add Suspicious Paths sigmaSafeBoot Registry Key Deleted Via Reg.EXE sigmaSecurity Event Logging Disabled via MiniNt Registry Key - Process sigmaService Registry Key Deleted Via Reg.EXE sigmaSuspicious Windows Defender Registry Key Tampering Via Reg.EXE sigmaVulnerable Driver Blocklist Registry Tampering Via CommandLine sigmaWindows AMSI Related Registry Tampering Via CommandLine sigmaWindows Credential Guard Registry Tampering Via CommandLine sigmaWindows Defender Context Menu Removed sigmaWindows EventLog Autologger Session Registry Modification Via CommandLine	13	42
`OriginalFileName`	`eq`	`auditpol.exe` sigmaAudit Policy Tampering Via Auditpol splunkWindows Audit Policy Auditing Option Disabled via Auditpol splunkWindows Audit Policy Cleared via Auditpol splunkWindows Audit Policy Disabled via Auditpol splunkWindows Audit Policy Disabled via Legacy Auditpol splunkWindows Audit Policy Excluded Category via Auditpol splunkWindows Audit Policy Restored via Auditpol splunkWindows Audit Policy Security Descriptor Tampering via Auditpol splunkWindows Global Object Access Audit List Cleared Via Auditpol	9	10
`OriginalFileName`	`eq`	`powershell_ise.exe` sigmaSuspicious Uninstall of Windows Defender Feature via PowerShell sigmaSuspicious Windows Service Tampering sigmaWindows Defender Context Menu Removed splunkPowershell Disable Security Monitoring splunkWindows Impair Defense Add Xml Applocker Rules	5	51
`OriginalFileName`	`eq`	`sc.exe` sigmaDisable Windows Defender AV Security Monitoring sigmaService StartupType Change Via Sc.EXE sigmaSuspicious Windows Service Tampering splunkWindows Attempt To Stop Security Service	4	26
`OriginalFileName`	`eq`	`wmic.exe` sigmaPotential Windows Defender Tampering Via Wmic.EXE sigmaService Startup Type Change Via Wmic.EXE sigmaSuspicious Windows Service Tampering splunkProcess Kill Base On File Path	4	61
`process_name`	`eq`	`auditpol.exe` splunkWindows Audit Policy Auditing Option Disabled via Auditpol splunkWindows Audit Policy Cleared via Auditpol splunkWindows Audit Policy Disabled via Auditpol splunkWindows Audit Policy Disabled via Legacy Auditpol splunkWindows Audit Policy Excluded Category via Auditpol splunkWindows Audit Policy Restored via Auditpol splunkWindows Audit Policy Security Descriptor Tampering via Auditpol splunkWindows Global Object Access Audit List Cleared Via Auditpol	8	10
`CommandLine`	`contains`	`add` sigmaHypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine sigmaSuspicious Windows Defender Folder Exclusion Added Via Reg.EXE sigmaVulnerable Driver Blocklist Registry Tampering Via CommandLine sigmaWindows Credential Guard Registry Tampering Via CommandLine sigmaWindows EventLog Autologger Session Registry Modification Via CommandLine	5	11
`CommandLine`	`contains`	`delete` sigmaDisable Windows Defender AV Security Monitoring sigmaPotential Tampering With Security Products Via WMIC sigmaRaccine Uninstall splunkProcess Kill Base On File Path splunkWindows Raccine Scheduled Task Deletion	5	22
`CommandLine`	`contains`	`/set` splunkWindows Audit Policy Auditing Option Disabled via Auditpol splunkWindows Audit Policy Disabled via Auditpol splunkWindows Audit Policy Excluded Category via Auditpol splunkWindows Audit Policy Security Descriptor Tampering via Auditpol	4	6
`CommandLine`	`contains`	`add-mppreference` sigmaPowershell Base64 Encoded MpPreference Cmdlet sigmaPowershell Defender Disable Scan Feature sigmaPowershell Defender Exclusion splunkAdd or Set Windows Defender Exclusion	4	4
`CommandLine`	`contains`	`disable` sigmaAudit Policy Tampering Via Auditpol splunkDisabling Firewall with Netsh splunkPowershell Disable Security Monitoring splunkWindows Audit Policy Disabled via Auditpol	4	7
`CommandLine`	`contains`	`set-mppreference` sigmaPowershell Base64 Encoded MpPreference Cmdlet sigmaPowershell Defender Disable Scan Feature sigmaPowershell Defender Exclusion splunkAdd or Set Windows Defender Exclusion	4	4
`CommandLine`	`contains`	`si` sigmaHypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine sigmaVulnerable Driver Blocklist Registry Tampering Via CommandLine sigmaWindows Credential Guard Registry Tampering Via CommandLine sigmaWindows EventLog Autologger Session Registry Modification Via CommandLine	4	5
`CommandLine`	`contains`	`add` sigmaAdd SafeBoot Keys Via Reg Utility sigmaSecurity Event Logging Disabled via MiniNt Registry Key - Process sigmaSuspicious Windows Defender Registry Key Tampering Via Reg.EXE	3	15
`CommandLine`	`contains`	`delete` sigmaSafeBoot Registry Key Deleted Via Reg.EXE sigmaService Registry Key Deleted Via Reg.EXE sigmaSuspicious Windows Service Tampering	3	5
`CommandLine`	`contains`	`0` sigmaDisabling Windows Defender WMI Autologger Session via Reg.exe sigmaSuspicious Windows Defender Folder Exclusion Added Via Reg.EXE sigmaWrite Protect For Storage Disabled	3	4
`EventID`	`eq`	`4104` splunkPowershell Remove Windows Defender Directory splunkPowershell Windows Defender Exclusion Commands splunkUnloading AMSI via Reflection splunkWindows PowerShell Disable HTTP Logging splunkWindows Powershell Import Applocker Policy	5	268
`TargetObject`	`contains`	`\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\` sigmaDiamond Sleet APT Scheduled Task Creation - Registry sigmaHide Schedule Task Via Index Value Tamper sigmaRemoval Of Index Value to Hide Schedule Task - Registry sigmaRemoval Of SD Value to Hide Schedule Task - Registry	4	4

Exclusions (167 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Field	Kind	Value	Rules excluding
`CommandLine`	`contains`	`/?` splunkWindows Audit Policy Excluded Category via Auditpol splunkWindows Audit Policy Restored via Auditpol splunkWindows Audit Policy Security Descriptor Tampering via Auditpol splunkWindows Global Object Access Audit List Cleared Via Auditpol	4
`Image`	`ends_with`	`\msmpeng.exe` sigmaDisable Tamper Protection on Windows Defender sigmaHackTool - SysmonEnte Execution sigmaPotential AutoLogger Sessions Tampering sigmaRemoval Of AMSI Provider Registry Keys	4
`Image`	`ends_with`	`\tiworker.exe` sigmaChange Winevt Channel Access Permission Via Registry sigmaDisable Windows Event Logging Via Registry	2
`Image`	`in`	`:\\windows\\system32\\` splunkWindows Cisco Secure Endpoint Stop Immunet Service Via Sfc splunkWindows Cisco Secure Endpoint Unblock File Via Sfc splunkWindows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc	3
`Image`	`in`	`:\\windows\\syswow64\\` splunkWindows Cisco Secure Endpoint Stop Immunet Service Via Sfc splunkWindows Cisco Secure Endpoint Unblock File Via Sfc splunkWindows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc	3
`Image`	`in`	`:\\windows\\winsxs\\*` splunkWindows Cisco Secure Endpoint Stop Immunet Service Via Sfc splunkWindows Cisco Secure Endpoint Unblock File Via Sfc splunkWindows Cisco Secure Endpoint Uninstall Immunet Service Via Sfc	3
`Image`	`starts_with`	`c:\programdata\microsoft\windows defender\platform\` sigmaDisable Tamper Protection on Windows Defender sigmaPotential AutoLogger Sessions Tampering sigmaRemoval Of AMSI Provider Registry Keys	3
`Image`	`starts_with`	`c:\program files (x86)\windows defender\` sigmaPotential AutoLogger Sessions Tampering sigmaRemoval Of AMSI Provider Registry Keys	2
`Image`	`starts_with`	`c:\program files\windows defender\` sigmaPotential AutoLogger Sessions Tampering sigmaRemoval Of AMSI Provider Registry Keys	2
`Image`	`starts_with`	`c:\windows\winsxs\` sigmaChange Winevt Channel Access Permission Via Registry sigmaDisable Windows Event Logging Via Registry	2
`CommandLine`	`in`	`/?` splunkWindows Audit Policy Cleared via Auditpol splunkWindows Audit Policy Disabled via Auditpol	2
`Image`	`eq`	`c:\windows\servicing\trustedinstaller.exe` sigmaChange Winevt Channel Access Permission Via Registry sigmaDisable Windows Event Logging Via Registry	2
`Image`	`eq`	`c:\windows\system32\svchost.exe` sigmaDisable Windows Event Logging Via Registry sigmaWFP Filter Added via Registry	2
`Image`	`eq`	`c:\windows\system32\wevtutil.exe` sigmaDisable Windows Event Logging Via Registry sigmaPotential AutoLogger Sessions Tampering	2
`CallTrace`	`contains`	`microsoft.build.ni.dll` sigmaSuspicious Svchost Process Access	1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Disable or Modify Tools `T1685`

Events covered

Authoring guide

Fields filtered most (62 distinct)

Top indicator values (1705 distinct)

Exclusions (167 distinct)

Rules under this technique

Sigma 167 rules

Splunk 107 rules

Keyboard shortcuts

Search operators

Disable or Modify Tools T1685

Events covered

Authoring guide

Fields filtered most (62 distinct)

Top indicator values (1705 distinct)

Exclusions (167 distinct)

Rules under this technique

Sigma 167 rules

Splunk 107 rules

Disable or Modify Tools `T1685`