Technique T1562

Impair Defenses

CLEARED FOR PUBLIC RELEASE · OPEN-SOURCE INTELLIGENCE

Impair Defenses (T1562) — a Defense Evasion technique, observed in public incident reporting.

MITRE ATT&CKT1562

TacticDefense Evasion

Incidents on file25

Detection & mitigation

Monitor for unexpected termination or removal of security-related processes and system extensions, especially via built-in macOS commands like `launchctl` or `kextunload`. Enforce application whitelisting and restrict access to system management commands for standard users.

Observed in the wild

2026-06-25

disable or modify tools
macOS Flaw Allows Standard Users to Disable EDR and MDM

2026-06-25

disable or modify tools
CVE-2026-39118 in macOS Allows Standard Users to Disable Security Agents

2026-05-25

tamper protection bypass
Cloud Atlas APT Patches termsrv.dll to Enable Multiple RDP Sessions

2026-05-25

etw tampering
MiniUpdate RAT Abuses Azure C2 and Evades EDR via ETW Disabling

2026-05-22

byovd
Software-Emulated Device Nodes Enable BYOVD Attacks Without Hardware

2026-05-21

amsi bypass
AMSI Bypass in Windows Scripting Host by Renaming WSCRIPT.EXE to AMSI.DLL

2026-05-21

disable or modify tools
The Gentlemen Ransomware Incidents with Defense Evasion via Event Log Clearing and Defender Tampering

2026-05-19

etw tampering
Micro-Stager: ETW TI Evasion via NtContinue in Managed Environments

2026-05-19

byovd
Lenovo Signed Driver Abused in BYOVD Attack to Terminate EDR Processes

2026-05-19

edr unhooking
GhostTree Attack Technique Disrupts EDR and Bypasses File Scanning on Windows

2026-05-16

amsi bypass
AI-Assisted Development of PowerShell AMSI Bypass for Signature Evasion Testing

2026-05-14

tamper protection bypass
Microsoft Patches Exploited UnDefend and RedSun Defender Zero-Days

2026-05-13

tamper protection bypass
Microsoft Defender Flaws Patched, BitLocker Bypass Emerges

2026-05-13

tamper protection bypass
SentinelOne Windows Agent Installer Updated to Mitigate BYOI Bypass Attacks

2026-05-12

edr unhooking
Technique to Detect EDR Inline Hooks in ntdll.dll by Comparing In-Memory and On-Disk Function Bytes

2026-05-01

tamper protection bypass
CopyFail Attack Demonstrates Kernel-Level EDR Evasion on Linux via Root Access

2026-04-20

disable or modify tools
The Gentlemen Ransomware-as-a-Service Affiliate Deploys SystemBC Proxy Malware

2026-04-18

amsi bypass
Research PoC: AMSI Bypass via amsiInitFailed Reflection and Fileless Payload Execution Detected by Sysmon

2026-04-17

tamper protection bypass
Microsoft Defender Zero-Day Vulnerabilities Actively Exploited in the Wild

2026-04-16

amsi bypass
PowMix botnet targets Czech workforce with AMSI bypass

2026-04-15

disable or modify tools
Digitally signed adware tool disables antivirus on thousands of endpoints

2026-04-05

byovd
PoisonX BYOVD Driver Bypasses CrowdStrike Falcon via Microsoft-Signed Kernel Driver

2026-03-30

edr unhooking
SysInject: EDR Hook Bypass via Proxy Calls and Exception Handler

2026-03-26

byovd
PoC Tool Uses BYOVD to Disable Driver Signature Enforcement via Kernel Memory Patching

2026-03-26

disable or modify tools
Forcepoint DLP Endpoint for macOS Process Suspension Bypass (SIGSTOP)

Track this in real time.

ColdRecon watches the public signal so you don't have to — a daily brief and a live detection-coverage desk. Request clearance.

Request Clearance →