Technique T1562

Impair Defenses

CLEARED FOR PUBLIC RELEASE · OPEN-SOURCE INTELLIGENCE

Impair Defenses (T1562) — a Defense Evasion technique, observed in public incident reporting.

MITRE ATT&CKT1562

TacticDefense Evasion

Incidents on file25

Detection & mitigation

Monitor for loading of known vulnerable or abused Microsoft-signed drivers (e.g., via Sysmon Event ID 6 or driver load events) and correlate with process termination of security products. Enforce driver block rules using Windows Defender Application Control or vulnerable driver blocklist to prevent loading of abused drivers.

Observed in the wild

2026-09-21

byovd
Fake LastPass Authenticator Installer Uses Microsoft-Signed Driver to Disable Antivirus and EDR

2026-09-21

edr unhooking
Remus Infostealer Removes Syscall Hooks to Evade EDR

2026-09-19

disable or modify tools
Rapuncel Infostealer Kills 145 Security Tools Before Stealing Credentials

2026-09-18

byovd
SETTRA ransomware abuses MeshAgent RMM and BYOVD to encrypt Windows systems

2026-09-17

amsi bypass
Advanced LausivLoader Campaign Uses Multi-Stage JavaScript/PowerShell Handoffs and Steganographic PNG Payloads

2026-09-17

disable or modify tools
Handala Hack Uses CRUDEEXCLUDE to Disable Defender Protections and Deploy HEAVYGRAM

2026-09-16

amsi bypass
PIVOTPIPE: New .NET-based Unofficial Beacon Payload with EDR Evasion

2026-09-15

disable or modify tools
Lesser-Known Ransomware Groups Continue Targeting Businesses in 2026

2026-09-12

disable or modify tools
Cisco Talos Attributes Firewall Vulnerability CVE-2026-20079 and Qilin Ransomware to Three Groups

2026-09-10

byovd
AOMEI Backupper amwrtdrv.sys local privilege escalation vulnerability

2026-09-08

disable or modify tools
Attackers Disable Endpoint Protection and Deploy Sliver C2 in Windows Domain Compromise

2026-09-08

disable or modify tools
The Gentlemen ransomware intrusion: domain admin creation and security tool disablement

2026-09-07

byovd
BYOTC Attack Abuses Trusted Windows Clients to Access Privileged Kernel Driver Operations

2026-09-06

disable or modify tools
Researchers demonstrate abuse of Windows Security Center APIs to disable security tools

2026-09-02

edr unhooking
Constructing a CrowdStrike EDR Evasion Debugging Pipeline

2026-09-02

disable or modify tools
RecoverIt: Using Windows Service Failure Recovery for Defense Evasion

2026-09-02

byovd
MoiClient evasive backdoor uses DLL side-loading, process injection, UAC bypass, and BYOVD

2026-09-02

disable or modify tools
Singularity Rootkit Bypasses Elastic Defend eBPF Module Load Detection

2026-09-02

disable or modify tools
Ransomware Group Builds Custom C2 Framework to Steal Passwords and Disable Security Tools

2026-09-01

disable or modify tools
Fake Cloudflare CAPTCHA tricks victims into opening a tunnel for attackers

2026-08-26

byovd
SPECTRE Backdoor Blinds CrowdStrike and SentinelOne at Kernel Level Without Killing Them

2026-08-25

disable or modify tools
Fake Microsoft Security Scan Scam Tricks Users into Removing Antivirus

2026-08-22

disable or modify tools
Gentlemen ransomware driver terminates 180 security processes before encryption

2026-08-21

disable or modify tools
Trojanized npm Packages Drop RedC2 4.0 Backdoor with AI-Assisted C2

2026-08-20

disable or modify tools
UAT-10147 Uses AI-Assisted Playbooks to Compromise IIS Servers and Add Defender Exclusions

Track this in real time.

ColdRecon watches the public signal so you don't have to — a daily brief and a live detection-coverage desk. Request clearance.

Request Clearance →