Technique T1562
Impair Defenses
Detection & mitigation
Monitor for unexpected termination of security processes (e.g., via Sysmon Event ID 5 or EDR telemetry) and for loading of unsigned or suspicious kernel drivers. Enforce driver signing policies and use application control to block unknown drivers.