{
  "technique_id": "T1685",
  "mappings": [
    {
      "attack_technique": "T1685 Disable or Modify Tools",
      "d3fend_technique": "Endpoint Health Beacon",
      "soc_action": "Detect when an EDR/monitoring agent stops reporting or heartbeats irregularly -- often the first visible sign a security tool was disabled or tampered with.\n",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "attack_technique": "T1685 Disable or Modify Tools",
      "d3fend_technique": "System Init Config Analysis",
      "soc_action": "Detect changes to startup/init configuration used to disable or block security agents from launching.\n",
      "tooling": [
        "Sentinel",
        "Defender for Endpoint"
      ]
    },
    {
      "attack_technique": "T1685 Disable or Modify Tools",
      "d3fend_technique": "Restore Configuration",
      "soc_action": "Re-enable or restore the security control's configuration once tampering is confirmed.\n",
      "tooling": [
        "Defender for Endpoint",
        "Entra ID"
      ]
    },
    {
      "attack_technique": "T1685 Disable or Modify Tools",
      "d3fend_technique": "System Call Filtering",
      "soc_action": "Apply tamper protection / system call filtering so security agents cannot be stopped or reconfigured by unauthorized processes.\n",
      "tooling": [
        "Defender for Endpoint"
      ]
    }
  ]
}