Full Report
Continuing our blog series on defense evasion, this blog dives into some practical, real-world examples of defense evasion in action.
Analysis Summary
# Tool/Technique: Defense Evasion via Impairing Defenses
## Overview
This technique involves adversaries manipulating, disabling, or reconfiguring security tools to avoid detection. Rather than bypassing security through complex exploits, threat actors leverage the legitimate functionality of security software (such as exclusion lists) or administrative tools to "blind" the security solution, ensuring their subsequent malicious actions remain unrecorded and unblocked.
## Technical Details
- **Type:** Technique (Defense Evasion)
- **Platform:** Windows
- **Capabilities:**
- Modification of Antivirus/EDR exclusion lists.
- Termination of protected security processes.
- Uninstallation of security agents.
- Manipulation of security tool configurations via PowerShell.
- **First Seen:** Ongoing; a core component of modern attack lifecycles.
## MITRE ATT&CK Mapping
- **TA0005 - Defense Evasion**
- **T1562 - Impair Defenses**
- **T1562.001 - Impair Defenses: Disable or Modify Tools**
## Functionality
### Core Capabilities
- **Legitimate Tool Manipulation:** Using built-in commands like `Add-MpPreference` in PowerShell to add malicious file paths or processes to Windows Defender’s exclusion list.
- **Service/Process Termination:** Attempting to stop or kill the processes associated with EDR (Endpoint Detection and Response) and AV (Antivirus) agents.
- **Uninstallation:** Executing the agent’s own uninstaller to remove security telemetry from the host.
### Advanced Features
- **Process Blinding (Backstab):** Leveraging the **Backstab** tool, which utilizes a legitimate Microsoft Sysinternals driver (ProcExp) to kill protected processes that are otherwise shielded from standard termination attempts.
- **Timing Evasion:** Strategic execution of defense impairment early in the kill chain to ensure all subsequent tools (RATs, Ransomware) are never analyzed by the security engine.
## Indicators of Compromise
- **File Names:** `Backstab.exe`, `procexp.sys` (when used maliciously).
- **Registry Keys:** Changes to `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions`.
- **Network Indicators:** (N/A for these specific local evasion techniques, though often followed by C2 activity to domains like `example[.]com`).
- **Behavioral Indicators:**
- Execution of `Add-MpPreference -ExclusionPath` or `-ExclusionProcess`.
- Unexpected calls to security agent uninstallation strings.
- Presence of Sysinternals drivers not associated with admin activity.
- Sudden cessation of telemetry from a previously active host.
## Associated Threat Actors
- **The Gentlemen (Ransomware group)**
- Various commodity malware operators and sophisticated APTs.
## Detection Methods
- **Signature-based detection:** Detecting known evasion tools like *Backstab* or *defendnot*.
- **Behavioral detection:**
- Monitoring PowerShell logs (Event ID 4104) for commands related to security preference modifications.
- Alerting on the loading of `procexp.sys` by unsigned or non-standard binaries.
- Monitoring for the "Impair Defenses" tactic where a process attempts to modify the registry keys of security software.
- **YARA rules:** Targeting specific strings found in Backstab or scripts that automate Defender exclusions.
## Mitigation Strategies
- **Prevention measures:** Implement Tamper Protection (specifically for Windows Defender) to prevent unauthorized changes to security settings via scripts.
- **Hardening recommendations:**
- Restrict administrative privileges to prevent the execution of high-privilege PowerShell commands.
- Use "Block" rules for known vulnerable drivers (Bring Your Own Vulnerable Driver - BYOVD protection).
- Enable PowerShell Constrained Language Mode (CLM) where possible.
## Related Tools/Techniques
- **Backstab:** Tool used to kill protected security processes.
- **defendnot:** A tool that uses undocumented APIs to bypass Windows Defender.
- **BYOVD (Bring Your Own Vulnerable Driver):** Using legitimate but vulnerable drivers to gain kernel-level access to disable security products.