Security teams detect indicator blocking by noticing when logs, alerts, or telemetry stop appearing from a host, user, or tool that should be reporting normally. Sudden gaps, disabled agents, and excluded paths are common signals. Validate collection health, protect security tooling settings, and investigate deliberate suppression quickly.
What indicator blocking looks like in telemetry
Indicator blocking usually shows up as a pattern, not a single alert. You are looking for reporting that suddenly becomes incomplete, inconsistent, or strangely quiet from a system that was previously visible. The practical clue is often absence of expected data, especially when the host, user, or tool still appears to be active.
A useful way to think about it is as a visibility failure with a cause. Logs may stop arriving, endpoint events may flatten, or a security tool may still be running but no longer producing the normal volume or type of telemetry. That change matters because attackers and insiders often prefer to suppress the evidence stream before continuing with activity.
When the gap is selective, it is even more suspicious. For example, a host may still report network traffic while process or script telemetry disappears, or only certain users, directories, or tools stop generating records. Those selective gaps often point to filtering, exclusion abuse, or deliberate tampering rather than a generic collector outage.
How to confirm it is not just a collection problem
The first step is to compare the missing data against a trusted baseline. Confirm whether other hosts, agents, or log sources in the same cohort are still healthy, then check whether the gap began after a configuration change, update, policy adjustment, or credential event. If the silence is isolated, treat it as a security signal rather than an operational inconvenience.
Cross-check from more than one layer. If the endpoint says the agent is healthy but the SIEM shows no new events, verify the collector path, queue depth, sensor status, and any recent exclusions or suppression rules. A host that can still generate observable activity outside the primary tool, but not inside it, may be intentionally hiding from your preferred control plane.
It also helps to validate from the outside in. Look for corroborating signs such as authentication activity, process creation, remote connections, or file changes that should have produced telemetry. If those secondary signals exist while the primary source stays quiet, the missing data is more likely to be deliberate blocking than simple downtime.
Where blocking usually comes from
The most common sources are tampering with security tooling, disabling agents or services, abusing exclusions, or reducing the scope of collection so that specific processes, paths, or event types disappear. Collection can also be blunted by log forwarding failures, local service disruption, or policy changes that quietly narrow what gets reported. The EDR Evasion and Defence Guide is a useful reference when you need to distinguish normal tuning from sensor blinding.
At the adversarial end, indicator blocking is often paired with other defence impairment techniques because suppressing telemetry makes later actions easier to hide. That includes deleting evidence, modifying exclusions, or interfering with the agent itself. The key operational point is that the blocking mechanism may be quieter than the payload it is helping conceal.
Teams should also remember that reporting gaps can affect different products differently. An attacker might blind one tool, but not another, so separate endpoint, network, identity, and application views often reveal the mismatch. Broader monitoring guidance such as the MITRE ATT&CK Enterprise Matrix helps map those suppression behaviours to known adversary techniques.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1562.001 — Impair Defenses: Disable or Modify Tools | Indicator blocking often uses tool tampering or disabled sensors to hide activity. |
| Recommendation — Map telemetry gaps to defense impairment techniques and hunt for tool tampering or disabled agents. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Missing logs and suppressed telemetry directly affect detection and audit visibility. |
| Recommendation — Validate log coverage and alert on sudden drops in expected telemetry volume. | ||
| NIST CSF 2.0 | DE.CM-01 — Detect anomalies and events | Selective silence is an anomaly in monitoring data that should be detected and triaged. |
| Recommendation — Alert on deviations from expected telemetry baselines and investigate unexplained gaps. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | Reviewing audit records for missing or suppressed events is central to spotting indicator blocking. |
| SI-4 — System Monitoring | System monitoring must surface when a host or sensor stops reporting normally. | |
| Recommendation — Correlate audit sources and investigate abrupt evidence loss or inconsistencies. Monitor endpoint health and sensor output for abrupt visibility loss. | ||
Practitioner Guidance
What to verify: Confirm whether the telemetry gap is isolated to one sensor, one host group, or one data type before you assume a platform outage. If the gap is selective, treat collection health as a potential compromise indicator and check for recent exclusions, disabled services, or policy drift.
Decision rule: If the system is still active but the expected telemetry has stopped, prioritise containment of the reporting path and the affected endpoint over waiting for more evidence. When visibility is being actively reduced, delay increases the chance that the next stage of activity remains unseen.
Common mistake: Teams often dismiss blocked indicators as noise because the security tool still looks “up.” A healthy status light is not the same as trustworthy data, especially when the tool is still installed but no longer emitting the events you rely on.
Practitioner takeaway: The best detection signal is usually a mismatch between expected activity and missing telemetry, so investigate silence as aggressively as you would an alert when the absence is selective and unexplained.