MITRE ATT&CK T1687 Exploitation for Defense Impairment: Detecting Attacks on Your Security Controls

Security tools are software, and a flaw in an endpoint agent, a firewall's inspection engine or a cloud security boundary can be used to switch protection off without ever touching a setting. MITRE ATT&CK v20 added T1687 Exploitation for Defense Impairment to describe this: adversaries may exploit vulnerabilities in security software, infrastructure or defensive components to degrade, disable or otherwise impair the ability to prevent, detect or respond to malicious activity. Unlike configuration tampering, there may be no audit event saying a control was changed, only a crash, a restart or a silence. This guide explains what T1687 covers and how it differs from neighbouring techniques, how to treat security tools as an attack surface with its own patch priority, the health and telemetry-gap detections that catch impairment, and how to respond when a control goes quiet. It is written for detection engineers, security operations and vulnerability management teams, and stays defensive. The tactic context is in the ATT&CK Stealth and Defense Impairment Tactics Guide, and the evasion overview in the Defence Evasion Techniques Guide.

Key takeaways

• Your controls are in scope. T1687 names antivirus, EDR, firewalls and other monitoring solutions, plus cloud and SaaS security boundaries, as targets. They need the same exposure management as any internet-facing application, with a faster clock.
• Silence is the signal. Exploitation may leave no configuration change. Agent crashes, unexpected restarts, driver or module unloads and gaps in telemetry are what MITRE's detection strategy DET0900 correlates.
• Discovery comes first. ATT&CK notes adversaries may use T1518 Software Discovery to identify the defensive tools present before targeting them, which gives you an earlier detection point.
• Layer controls that fail independently. If one agent can be crashed, network, identity and cloud control-plane telemetry should still see what happens next.
• Treat security vendor advisories as priority intake. Subscribe to every security vendor's advisories page, patch security tooling on a short service level, and keep tamper protection features turned on.

What T1687 covers in ATT&CK v20

T1687 sits in the Defense Impairment tactic (TA0112), introduced in ATT&CK v20 when the old defence evasion tactic was split into Stealth and Defense Impairment. It has no sub-techniques and lists IaaS, Linux, macOS, SaaS and Windows as platforms. MITRE's description says successful exploitation may allow adversaries to terminate security processes, disable protections, bypass enforcement mechanisms or reduce the effectiveness of defensive controls, and that vulnerabilities in cloud or SaaS infrastructure may be used to bypass built-in security boundaries or disrupt visibility across environments.

Several techniques sit close to it. The distinction is the goal and the mechanism:

Bring-your-own-vulnerable-driver attacks are a common route to killing endpoint agents, but they exploit a third-party driver to gain kernel privilege and then disable the agent, which maps more naturally to T1068 and T1685. They are covered in the Bring Your Own Vulnerable Driver and EDR Killers Guide. This page focuses on flaws in the defensive components themselves.

Where the attack surface is

Network security appliances at the perimeter are a particularly heavily targeted category; for their exposure management see the Edge Device Security Guide.

Detection: correlating precursor, degradation and follow-on

MITRE's detection strategy DET0900, Detection of Defense Impairment, has analytics for Windows, Linux, macOS, IaaS and SaaS. The common shape is three steps in a short window: unusual interaction with a security product, then degradation of the control, then follow-on activity that the control would have caught.

Rules worth building first

1. Telemetry gap per host: a host that was sending endpoint telemetry stops for longer than a threshold while the host is still seen on the network (DHCP, authentication, flow). MITRE's analytic exposes a TelemetryGapThreshold variable; our starting point is 15 minutes for servers.
2. Crash clusters: security agent crashes or restarts on several hosts in a short window, or repeatedly on one host, outside a known update rollout.
3. Crash then execution: a security service failure followed within minutes by new process execution, credential access or lateral movement from the same host.
4. Discovery then interaction: security software discovery (T1518.001 Security Software Discovery) followed by unusual processes opening handles to, or sending input to, security processes.
5. Control-plane degradation: any change that stops logging or reduces retention, from any principal, at high severity.

Keep a healthy baseline of normal agent restarts during updates so these rules do not drown in noise; a faulty vendor update can look like mass impairment, which is why a separate Security Tool Faulty Update Outage Playbook is worth having beside this detection. For building and testing the analytics see the ATT&CK Detection Strategies and Analytics Guide.

Prevention: managing security tools as attack surface

ATT&CK v20 does not map mitigation objects to T1687. The controls below are our recommendations, built from NIST patch management guidance and vendor product documentation.

• Inventory every defensive component: agents, sensors, appliances, cloud security services and SaaS security integrations, with version, owner and the advisories page for each vendor. NIST CSF 2.0 ID.RA-01 expects vulnerabilities in assets to be identified, validated and recorded; security tools are assets.
• A faster patch clock for security tools: NIST SP 800-40 Rev 4 frames patching as preventive maintenance. Put security tooling in its own maintenance group with a shorter service level than general software, because a flaw there weakens every other control. Our recommendation: treat any security product vulnerability listed in the CISA Known Exploited Vulnerabilities catalogue as an emergency change. See the CISA KEV Catalogue Guide.
• Turn on tamper protection features: many endpoint products offer tamper protection that locks security settings and blocks attempts to stop the agent. For example, Microsoft documents that Defender for Endpoint tamper protection on Windows locks settings such as real-time protection and exclusions, that macOS offers Audit and Block modes, and that tamper attempts surface as alerts and as TamperingAttempt events in advanced hunting. Check your own products' documentation for the equivalent and confirm it is enabled on every device.
• Reduce the reachable surface of security tools: restrict who and what can talk to agent management interfaces, appliance management planes and security service APIs (NIST SP 800-53 CM-7 Least Functionality). Management interfaces should not be reachable from user networks or the internet.
• Keep logs off the box: forward security tool and audit logs to a separate platform in near real time, and keep cloud audit logs in an account the workload administrators cannot change, so a crashed or impaired control has already shipped what it saw.
• Ask suppliers for secure by design: CISA's Secure by Design programme asks manufacturers to treat customer security as a core business requirement and to provide protections such as logging at no additional cost. Use those principles in procurement questions for security products.

Small and large organisations

A small organisation with one endpoint product and a cloud firewall can get most of the value from three things: automatic updates for the security tools, tamper protection turned on, and an alert when any device stops reporting. A large organisation should add a dedicated maintenance group and service level for security tooling, the crash and gap correlations above, and a second, independent telemetry source (network flow or identity logs) for critical servers.

Responding when a control goes quiet

1. Triage the silence: confirm the host is alive (network, authentication), check whether a vendor update or maintenance explains it, and check whether other hosts show the same pattern.
2. Assume compromise when unexplained: treat an unexplained loss of a security control on a server as an incident, not a ticket. Look at network and identity telemetry for the period of silence.
3. Contain with what still works: if the endpoint agent cannot isolate the host, isolate it at the switch, firewall or cloud security group, and disable or reset the accounts active on it.
4. Preserve evidence: collect crash dumps, agent logs, OS logs and memory where possible; send crash details to the security vendor through its support or vulnerability reporting channel.
5. Restore and harden: update the security product to a fixed version, confirm tamper protection, reinstall the agent where integrity is in doubt, and verify telemetry is flowing again before releasing the host.
6. Hunt across the fleet: search for the same precursor and crash pattern on other hosts running the same product version.

The step-by-step response is in the EDR Tampering and BYOVD Response Playbook.

Where identity fits

Security tools run on privileged non-human identities: agent service accounts, API keys used by SIEM and SOAR integrations, cloud roles granted to posture and detection services, and appliance administrator accounts. Exploiting a defensive component can hand an attacker those credentials as well as switching the control off. Scope each security tool's identities to the minimum, store their secrets in a vault, rotate them after any impairment incident, and alert on their use from unexpected sources. See the Non-Human Identity (NHI) Guide.

Measuring it

• Telemetry coverage: percentage of managed hosts reporting to the endpoint platform in the last hour (target above 98% for servers, our recommendation).
• Mean time to detect a silent host: minutes from last telemetry to an analyst acknowledging the gap alert.
• Security tool patch latency: median days from a security vendor advisory to fleet-wide deployment, reported separately from general patching.
• Tamper protection coverage: percentage of endpoints with tamper protection confirmed on.
• Off-box logging: percentage of security components whose logs reach a separate platform within five minutes.

Framework mapping

Common failure patterns

• Security tools outside vulnerability management: scanners and patch processes cover business applications but treat agents and appliances as the vendor's problem.
• No alert on silence: dashboards show which hosts are reporting, but nobody is paged when a server stops.
• One control, one point of failure: endpoint telemetry is the only source on critical servers, so when the agent is crashed there is nothing else to look at.
• Logs kept only on the device: appliance and agent logs are stored locally and lost or altered when the component is compromised.
• Crash noise accepted: agent crashes are closed as vendor bugs without checking what ran on the host next.
• Management planes exposed: security appliance and console administration reachable from user networks or the internet.

Practitioner checklist

• Inventory every defensive component with version, owner and vendor advisories page.
• Put security tooling in its own maintenance group with a shorter patch service level, and treat KEV-listed security product flaws as emergency changes.
• Confirm tamper protection is on across the fleet and alert on tamper attempts.
• Alert on telemetry gaps for hosts still seen on the network, starting with servers.
• Correlate security agent crashes and restarts with follow-on execution from the same host.
• Forward security tool, audit and cloud control-plane logs off the box in near real time.
• Restrict management interfaces of security tools to administrative networks.
• Scope, vault and rotate the identities used by security tools and integrations.

Standards and references

• MITRE ATT&CK: T1687 Exploitation for Defense Impairment
• MITRE ATT&CK: TA0112 Defense Impairment
• NIST: SP 800-40 Rev 4 Guide to Enterprise Patch Management Planning
• NIST: SP 800-53 Rev 5 Security and Privacy Controls
• CISA: Known Exploited Vulnerabilities Catalog
• CISA: Secure by Design
• Microsoft Learn: Protect security settings with tamper protection
• Microsoft Learn: Sysmon

Related NHI Mgmt Group resources: Defence Evasion Techniques Guide · ATT&CK Stealth and Defense Impairment Tactics Guide · Bring Your Own Vulnerable Driver and EDR Killers Guide · EDR Tampering and BYOVD Response Playbook