1. What Are “Impaired Defenses” in Cybersecurity?

Impaired defenses refer to intentional actions by attackers to weaken, evade, disable, or bypass security controls in a target environment so that malicious activities can proceed undetected, uninterrupted, or unblocked.

These defenses include:

• Antivirus / EDR
• Host-based firewalls
• Security logging & monitoring
• Application control (AppLocker, WDAC)
• Authentication & access controls
• Patch management mechanisms

From a kill-chain perspective, defense impairment is a force multiplier: it increases the success rate of persistence, privilege escalation, lateral movement, and data exfiltration.

---

2. Why Attackers Target Defenses (Strategic View)

Attackers impair defenses to achieve:

1. Stealth – avoid detection by SOC, SIEM, or EDR
2. Persistence – maintain long-term access
3. Operational Freedom – execute tools like Mimikatz, Cobalt Strike
4. Reliability – reduce risk of process termination or quarantine
5. Speed – accelerate ransomware deployment or data theft

Modern malware often disables defenses before payload execution, not after.

---

3. Defense Impairment Across the Attack Lifecycle

Initial Access → Persistence → Privilege Escalation → Lateral Movement → Impact

Defense impairment typically occurs early and is often repeated throughout the intrusion.

Example:

• Disable Defender → Dump LSASS → Move laterally → Disable logging → Deploy ransomware

---

4. MITRE ATT&CK: Impair Defenses (TA0005)

Core MITRE Tactic

TA0005 – Defense Evasion

This tactic explicitly covers actions taken to avoid or neutralize security mechanisms.

---

5. Key Techniques Used to Impair Defenses

5.1 Disable or Modify Security Tools

MITRE Technique:

• T1562 – Impair Defenses

Sub-Techniques:

• T1562.001 – Disable or Modify Tools
• T1562.004 – Disable or Modify System Firewall

Technical Actions:

• Stopping AV/EDR services
• Tampering with configuration files
• Killing EDR agent processes
• Unloading kernel drivers (advanced attackers)

Example Commands:

Set-MpPreference -DisableRealtimeMonitoring $true
sc stop WinDefend
taskkill /F /IM MsSense.exe

---

5.2 Tampering with Security Configuration (Registry)

Attackers manipulate registry keys controlling security behavior.

Common Registry Paths:

HKLM\SOFTWARE\Microsoft\Windows Defender
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender
HKLM\SYSTEM\CurrentControlSet\Services\WinDefend

Example Registry Changes:

DisableAntiSpyware = 1
DisableRealtimeMonitoring = 1

---

5.3 Disabling Logging & Auditing

MITRE Techniques:

• T1562.002 – Disable Windows Event Logging
• T1070.001 – Clear Windows Event Logs

Methods:

• Stopping EventLog service
• Clearing logs to erase forensic evidence
• Disabling PowerShell Script Block Logging

wevtutil cl Security
wevtutil cl System

Registry:

HKLM\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging
EnableScriptBlockLogging = 0

---

5.4 Firewall & Network Defense Bypass

MITRE Technique:

• T1562.004 – Disable or Modify System Firewall

Actions:

netsh advfirewall set allprofiles state off

Registry:

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy

---

5.5 EDR / AV Evasion Techniques

MITRE Techniques:

• T1027 – Obfuscated Files or Information
• T1218 – Signed Binary Proxy Execution
• T1055 – Process Injection

Used to:

• Run malware in trusted processes
• Avoid signature-based detection
• Evade behavioral analysis

---

5.6 Kernel-Level Defense Evasion (Advanced Threats)

Used by APTs & ransomware groups

• BYOVD (Bring Your Own Vulnerable Driver)
• Disable EDR via kernel driver abuse

MITRE Technique:

• T1068 – Exploitation for Privilege Escalation
• T1543.003 – Create or Modify System Process: Windows Service

---

6. Indicators of Compromise (IOCs)

Process-Level IOCs

• Unexpected termination of:
  • MsSense.exe
  • WinDefend.exe
  • SenseIR.exe
• Suspicious PowerShell with Defender cmdlets

File-Level IOCs

• Dropped tools:
  • gmer.sys
  • aswArPot.sys
  • RTCore64.sys (BYOVD)

Registry IOCs

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = 1
HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = 1

Event Log IOCs

• Event ID 1102 – Audit log cleared
• Sudden absence of Defender events
• Service stop/start anomalies

---

7. Detection & Defensive Controls

Blue Team Countermeasures

• Tamper Protection (Defender)
• EDR self-protection modules
• SIEM alerts for:
  • Defender configuration changes
  • Event log clearing
• Attack Surface Reduction (ASR) rules
• Registry change monitoring

---

8. Summary Table (As Requested)

Attack Action	MITRE Technique	Tool / Method	Registry Path	IOC Examples
Disable Antivirus	T1562.001	PowerShell, sc.exe	HKLM\SOFTWARE\Microsoft\Windows Defender	Defender service stopped
Disable Firewall	T1562.004	netsh	HKLM\SYSTEM\CCS\Services\SharedAccess	Firewall state = off
Clear Event Logs	T1070.001	wevtutil	N/A	Event ID 1102
Disable PowerShell Logging	T1562.002	Registry edit	HKLM\Software\Policies\Microsoft\Windows\PowerShell	ScriptBlockLogging = 0
Kill EDR Process	T1055	Process Injection	N/A	MsSense.exe terminated
Kernel Driver Abuse	T1068	BYOVD	HKLM\SYSTEM\CCS\Services	Vulnerable driver loaded
Modify Defender Policy	T1562.001	reg.exe	HKLM\SOFTWARE\Policies\Microsoft\Windows Defender	DisableAntiSpyware = 1

---

9. Key Takeaway