{
  "technique_id": "T1685",
  "name": "Disable or Modify Tools",
  "tactics": [
    "Defense Impairment"
  ],
  "platforms": [
    "Windows",
    "Linux",
    "macOS",
    "Azure AD",
    "Office 365"
  ],
  "summary": "Adversaries may disable, degrade, or tamper with security tools -- EDR, antivirus, logging agents, sensors -- to impair or reduce visibility of defensive capabilities. This also includes blocking or manipulating the indicators and telemetry those tools rely on for detection, not just disabling the tool itself. Formerly tracked as \"Impair Defenses\" (T1562), renamed and moved to the Defense Impairment tactic.\n",
  "generated_by": "SOC Response Atlas by Basyrix"
}