T1687 — Exploitation for Defense Impairment

Tactic: Defense Impairment · Platforms: IaaS, Linux, macOS, SaaS, Windows

Adversaries may exploit vulnerabilities in security software, infrastructure, or defensive components to degrade, disable, or otherwise continue to impair their ability to prevent, detect, or respond to malicious activity. Adversaries may exploit a system or application vulnerability to directly…

Sigma detection rules (5)

title: T1687 Exploitation for Defense Impairment
id: 95ba7839-20c4-461f-b6c8-a6276c433121
description: 'Detects loading of known vulnerable/abusable kernel drivers (e.g. those bundled with Zemana AntiMalware, GMER/RTCore, or Dell dbutil) associated with Bring-Your-Own-Vulnerable-Driver (BYOVD) toolkits such as Terminator/AuKill/EDRSandBlast, used to exploit a kernel-level vulnerability and crash or blind AV/EDR/security agents. Tune using: CrashCorrelationWindow, ProtectedServiceList, TelemetryGapThreshold.'
references:
  - https://attack.mitre.org/techniques/T1687
author: Shahrukh Khan
date: 2026-04-15
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1687

logsource:
  category: driver_load
  product: windows
  service: sysmon

detection:
  selection:
    ImageLoaded|endswith:
      - '\zamguard64.sys'
      - '\zam64.sys'
      - '\gdrv.sys'
      - '\rtcore64.sys'
      - '\dbutil_2_3.sys'
      - '\procexp152.sys'

  condition: selection

falsepositives:
  - Legitimate use of Zemana AntiMalware, GMER, MSI Afterburner/RTCore, Dell firmware-update utilities (dbutil), or Sysinternals Process Explorer, all of which load these same drivers for benign purposes -- baseline against known-good software inventory.

level: high

title: T1687 Exploitation for Defense Impairment
id: 7c487dbf-eabd-4265-adde-afcb03ea7132
description: 'Detects a process masquerading as a known security/monitoring tool (auditd, falco, clamd, freshclam, snort, suricata, ossec-agentd, wazuh-agentd) by matching the tool''s expected process name (comm) while executing from a binary path that does not match its standard installation location -- a strong single-event indicator that the security tool''s own binary was replaced, hijacked, or exploited to run adversary-controlled code, rather than the process_creation of an unrelated module-unload (rmmod/modprobe) which is closer to T1562.001 tampering than to exploitation. A full chain of exploitation (crash, then anomalous privilege gain) still requires correlation across multiple events/hosts that auditd alone cannot provide; this rule targets the resulting hijacked-binary execution instead. Tune using: ExpectedToolPaths, AllowedCustomInstallDirs.'
references:
  - https://attack.mitre.org/techniques/T1687
author: Shahrukh Khan
date: 2026-05-01
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1687

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_security_tool_name:
    type: EXECVE
    comm:
      - 'auditd'
      - 'falco'
      - 'clamd'
      - 'freshclam'
      - 'snort'
      - 'suricata'
      - 'ossec-agentd'
      - 'wazuh-agentd'
  filter_expected_install_path:
    exe:
      - '/usr/sbin/auditd'
      - '/usr/bin/falco'
      - '/usr/sbin/clamd'
      - '/usr/bin/freshclam'
      - '/usr/sbin/snort'
      - '/usr/bin/suricata'
      - '/var/ossec/bin/ossec-agentd'
      - '/var/ossec/bin/wazuh-agentd'

  condition: selection_security_tool_name and not filter_expected_install_path

falsepositives:
  - Custom or containerized installations of these tools running from non-default paths (e.g. /opt, /usr/local, snap/flatpak confinement directories); baseline ExpectedToolPaths per environment before enabling at high severity.

level: high

title: T1687 Exploitation for Defense Impairment
id: 546840c4-7a1a-491d-b193-5e6169480883
description: 'Detection of Defense Impairment. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ExtensionList, CrashBurstThreshold.'
references:
  - https://attack.mitre.org/techniques/T1687
author: Shahrukh Khan
date: 2026-05-05
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1687

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/killall'
    CommandLine|contains:
      - 'com.apple.security'
      - 'XProtect'

  condition: selection

falsepositives:
  - Unified log process metadata shows individual process terminations but not a correlated crash-burst rate for a specific extension, so this rule can only catch a manual killall invocation and will miss extension crashes induced through a crafted malformed input.

level: high

title: T1687 Exploitation for Defense Impairment
id: cd566cc0-e8fa-4751-bcd4-1f080bc801eb
description: 'Detection of Defense Impairment. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CriticalTrailList, ControlChangeWindow.'
references:
  - https://attack.mitre.org/techniques/T1687
author: Shahrukh Khan
date: 2026-01-07
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1687

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource: 'cloudtrail.amazonaws.com'
    eventName:
      - 'StopLogging'
      - 'DeleteTrail'
      - 'UpdateTrail'

  condition: selection

falsepositives:
  - Authorized trail reconfiguration during a logging architecture migration performed by the cloud security team.

level: critical

title: T1687 Exploitation for Defense Impairment
id: 250d6921-948a-4375-a9f0-18dda19f02a8
description: 'Detection of Defense Impairment. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: PrivilegedActorAllowlist, RetentionChangeThreshold.'
references:
  - https://attack.mitre.org/techniques/T1687
author: Shahrukh Khan
date: 2026-04-08
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1687

logsource:
  product: saas
  service: okta

detection:
  selection_policy:
    eventType: 'policy.lifecycle.update'
  selection_uri:
    debugContext.debugData.requestUri|contains: '/api/v1/policies'
  selection_outcome:
    outcome.result: 'SUCCESS'

  condition: all of selection_*

falsepositives:
  - Routine identity-team policy administration performed against the same management API endpoints as a genuine attack against a policy engine flaw.

level: medium

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1687 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan