ATT&CK technique
View on MITRE ATT&CK →
T1562.006
Indicator Blocking
Stealth
deprecated
7 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Sensitive Audit Policy Sub-Category Disabled | production | 2026-10-19 |
| elastic | Suspicious Kernel Feature Activity | production | 2026-10-09 |
| elastic | Windows Defender Disabled via Registry Modification | production | 2026-09-18 |
| elastic | AWS CloudWatch Alarm Deletion | production | 2026-09-18 |
| elastic | Disable Windows Event and Security Logs Using Built-in Tools | production | 2026-09-18 |
| elastic | Windows Defender Exclusions Added via PowerShell | production | 2026-09-18 |
| elastic | Kill Command Execution | production | 2026-09-18 |