Bypass Record
Disable or Modify Tools × Microsoft Windows Defender
A publicly-reported instance of Disable or Modify Tools bypassing Microsoft Windows Defender, recorded with its original source. Factual record; no assessment of any specific deployment.
Reported as
Attackers with administrative access disabled security tools (Defender, Sysmon, WAF) via service control or configuration changes
Mechanism
Attackers with administrative access disabled security tools (Defender, Sysmon, WAF) via service control or configuration changes, then executed Mimikatz to extract credentials from LSASS memory, bypassing detection and logging.
Detection & mitigation
Monitor for unexpected service stoppages or configuration changes to Windows Defender and Sysmon (Event IDs 7036, 7045, 5001, 5007). Deploy tamper protection and restrict administrative privileges to prevent disabling of security tools.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.