T1685.003 — Modify or Spoof Tool UI

Tactic: Defense Impairment · Platforms: Linux, macOS, Windows

Adversaries may spoof or manipulate security tool user interfaces (UIs) to falsely indicate tools are functioning normally and delay detection and response. Adversaries may present misleading or falsified security tool interfaces (UIs) that display normal or healthy status indicators, even when…

Sub-technique of Disable or Modify Tools (T1685).

Sigma detection rules (3)

T1685.003 Disable or Modify Tools: Modify or Spoof Tool UI

title: "T1685.003 Disable or Modify Tools: Modify or Spoof Tool UI"
id: a12e27a4-6744-4426-94a4-d513955ce0e9
description: 'Detects execution of known security-tool UI/tray binaries (e.g. Windows Defender health/tray components) from non-standard file paths, a proxy for tool-UI spoofing (the previous version matched sc.exe disabling a service via config start=disabled, which is Disable or Modify Tools, T1562, not UI spoofing). Note: genuine in-place overlay/spoofing of a running tool''s rendered status is not directly observable via Sysmon telemetry; this rule instead flags the closest defensible proxy -- a security-tool-UI-named binary executing from an unexpected path. Tune using: ServiceNameList, FakeUIProcessPatterns.'
references:
  - https://attack.mitre.org/techniques/T1685/003
author: Shahrukh Khan
date: 2026-05-22
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1685.003

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith:
      - '\MsMpEng.exe'
      - '\SecurityHealthSystray.exe'
      - '\SecurityHealthService.exe'
      - '\MSASCuiL.exe'
  filter_legit_path:
    Image|startswith:
      - 'C:\Program Files\Windows Defender\'
      - 'C:\ProgramData\Microsoft\Windows Defender\platform\'
      - 'C:\Windows\System32\'

  condition: selection and not filter_legit_path

falsepositives:
  - Legitimate Windows Defender or third-party AV components relocated by unusual but authorized deployment tooling -- verify Image path and digital signature before escalating.

level: high

T1685.003 Disable or Modify Tools: Modify or Spoof Tool UI

title: "T1685.003 Disable or Modify Tools: Modify or Spoof Tool UI"
id: c54e9495-6465-432d-a1bd-d0095ef25232
description: 'True UI/tray-icon spoofing of security-tool status is a GUI/X11-level behavior with no auditd or syscall trace and cannot be directly observed via Linux audit telemetry; the prior version actually detected killing a security daemon, which is T1562.001 (Disable or Modify Tools), not this technique. This rule instead implements the closest Linux-observable proxy: termination of a security daemon (falco/auditd/wazuh-agent/osqueryd) combined with execution of a same-named process (masquerading) from a non-standard path, consistent with an adversary replacing the real agent with a fake one that reports a healthy/protected status. Tune using: SecurityDaemonList, LegitimateBinaryPaths.'
references:
  - https://attack.mitre.org/techniques/T1685/003
author: Shahrukh Khan
date: 2026-05-13
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1685.003

logsource:
  category: process_creation
  product: linux

detection:
  selection_kill:
    type: EXECVE
    a0|endswith:
      - '/kill'
      - '/pkill'
      - '/killall'
  selection_daemon:
    a1|contains:
      - 'falco'
      - 'auditd'
      - 'wazuh-agent'
      - 'osqueryd'
  selection_masquerade:
    type: EXECVE
    comm:
      - 'falco'
      - 'auditd'
      - 'wazuh-agent'
      - 'osqueryd'
    exe|contains:
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'
      - '/home/'

  condition: (selection_kill and selection_daemon) or selection_masquerade

falsepositives:
  - Legitimate restart of a security daemon (falco, osqueryd, auditd, wazuh-agent) during a patch cycle; legitimate agent reinstallation to a nonstandard support/debug path.

level: high

T1685.003 Disable or Modify Tools: Modify or Spoof Tool UI

title: "T1685.003 Disable or Modify Tools: Modify or Spoof Tool UI"
id: f90cf6cb-721e-413e-95bb-39fc6c8119e0
description: 'Detection for Spoofing Tool UI across OS Platforms. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TrustedDaemonList.'
references:
  - https://attack.mitre.org/techniques/T1685/003
author: Shahrukh Khan
date: 2026-04-04
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1685.003

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/launchctl'
    CommandLine|contains: 'disable'

  condition: selection

falsepositives:
  - Approved MDM configuration profiles that intentionally disable a specific non-essential daemon as part of a fleet hardening baseline.

level: high

Related sub-techniques

Explore