T1685

Disable or Modify Tools

discovered 2026-07-08

Defender/security-tool tampering reported across the post-execution chain (ATT&CK v19 Defense Impairment technique; Socket's mapping).

View on MITRE ATT&CK

Seen in packages

Campaigns