MITRE ATT&CK KQL Explorer

697 techniques · 102 KQL queries · 71 with detections

Has KQL

T1685Disable or Modify Tools

Defense Impairment

View on MITRE ATT&CK →

4 Queries

Security Tool or Service Disabled via Command Line

highproductionMicrosoft Sentinel

Microsoft Defender for Endpoint·DeviceProcessEvents

DeviceProcessEvents
| where Timestamp > ago(1d)
| where ProcessCommandLine has_any ("sc stop", "sc delete", "sc config", "net stop", "Set-MpPreference -DisableRealtimeMonitoring", "netsh advfirewall set", "Uninstall-WindowsFeature", "Remove-MpPreference")
| where ProcessCommandLine has_any ("WinDefend", "MsMpSvc", "Sense", "MpsSvc", "wscsvc", "SecurityHealthService", "DisableRealtimeMonitoring", "advfirewall")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc

triathIC · last tested 2025-03-01

ClickFix Chain Correlation: Proxy Execution + AppData Persistence + Defender Tamper

highexperimentalDefender XDR

Microsoft Defender for Endpoint·DeviceProcessEventsDeviceRegistryEvents

let lookback = 3d;
let proxyChain = DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where InitiatingProcessFileName =~ "pcalua.exe" and FileName in~ ("mshta.exe", "msiexec.exe")
    | project DeviceId, DeviceName, ProxyTime = Timestamp, ProxyCmd = ProcessCommandLine;
let runKey = DeviceRegistryEvents
    | where Timestamp > ago(lookback)
    | where ActionType == "RegistryValueSet"
    | where RegistryKey has "CurrentVersion" and RegistryKey has "Run"
    | where RegistryValueData has_any ("AppData", "ProgramData")
    | project DeviceId, KeyTime = Timestamp, RegistryValueData;
let defenderTamper = DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where ProcessCommandLine has_any ("Set-MpPreference", "Add-MpPreference -ExclusionPath", "DisableRealtimeMonitoring", "Stop-Service WinDefend")
    | project DeviceId, TamperTime = Timestamp, TamperCmd = ProcessCommandLine;
proxyChain
| join kind=inner runKey on DeviceId
| join kind=inner defenderTamper on DeviceId
| where abs(datetime_diff('minute', ProxyTime, KeyTime)) <= 30
    and abs(datetime_diff('minute', ProxyTime, TamperTime)) <= 30
| project DeviceName, DeviceId, ProxyTime, ProxyCmd, KeyTime, RegistryValueData, TamperTime, TamperCmd, chain = "ClickFix->Loader->DefenderTamper"
| sort by ProxyTime asc

triathIC · last tested 2026-07-24

Tuning notes

Widen the 30m window if the operator spaces the legs out; narrow it to cut FPs in noisy admin environments. Add a first-leg anchor (unsigned/AppData process creation) to raise precision. Worthless on an unmonitored endpoint – the join needs the on-device telemetry that patient zero lacked.

Microsoft Defender Teardown: Set-MpPreference / Exclusions / Service Stop

highexperimentalDefender XDR

Microsoft Defender for Endpoint·DeviceProcessEventsDeviceRegistryEvents

DeviceProcessEvents
| where Timestamp > ago(3d)
| where ProcessCommandLine has_any (
    "Set-MpPreference", "Add-MpPreference -ExclusionPath",
    "DisableRealtimeMonitoring", "DisableIOAVProtection", "DisableBehaviorMonitoring", "DisableScriptScanning",
    "Stop-Service WinDefend", "config WinDefend start= disabled", "Stop-Service wscsvc", "Stop-Service SecurityHealthService")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp asc

triathIC · last tested 2026-07-24

Tuning notes

FP: AV migrations and legitimate IT maintenance touch these controls. The tell is the SEQUENCE (toggles -> exclusion -> service stop) on one host in minutes, ideally right after an AppData-resident process appeared. FN: the in-memory AMSI patch never hits a command line, so this catches the PowerShell/sc.exe legs, not the patch.

+ Add another query for this technique →