T1562 — Impair Defenses | MITRE Spotlight

Ransomware gangs disable your defenses before you even know they're inside.

MITRE Spotlight | DFIR Media

• Attackers use MITRE T1562 to turn off EDR, Windows Defender, and Sysmon.
• They run sc stop commands to kill security services before deploying ransomware.
• Event ID 7045 shows new services being installed to remove EDR agents.
• Tamper protection alerts fire when attackers try to disable audit policies.
• Hunt for sc delete commands targeting known EDR service names in your logs.
• This technique is the final step before ransomware encrypts everything.

AI-generated narration | DFIR Media

Видео T1562 — Impair Defenses | MITRE Spotlight канала DFIR Lab