Bypass Record

Disable or Modify Tools × EasyAntiCheat

A publicly-reported instance of Disable or Modify Tools bypassing EasyAntiCheat, recorded with its original source. Factual record; no assessment of any specific deployment.

Product
EasyAntiCheat
Technique
Disable or Modify Tools
MITRE ATT&CK
T1562.001
Confidence
High
Severity
High
Status
poc
Disclosed
2024-07-02
Config / version noted
Not stated

Provenance

Reported as

bypasses EasyAntiCheat (EAC) in Sea of Thieves by modifying the game's settings.json to invalidate sandboxid, deploymentid, and productid, preventing EAC initialization

Mechanism

The bypass modifies the 'sandboxid', 'deploymentid', and 'productid' fields in the game's settings.json configuration file to invalid values, causing EasyAntiCheat initialization to fail. The tool then reverts the file to its original state when the game executable launches to evade any integrity checks.

Detection & mitigation

Monitor for modifications to game configuration files (e.g., settings.json) by non-game processes, especially changes to anti-cheat related fields like sandboxid, deploymentid, or productid. Use file integrity monitoring (FIM) and restrict write permissions to these files to only trusted game updaters.

Disable or Modify Tools has also been recorded against

This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.