Suspicious Disable Security Utilities (via process_creation)

title: Suspicious Disable Security Utilities (via process_creation)
id: 7b5cc742-fe08-53df-b921-65f0c2316fab
status: stable
description: This rule detects disabling security tools
references:
    - https://attack.mitre.org/techniques/T1685/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
author: Huntrule Team
date: 2026-02-02
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: process_creation
    product: macos
detection:
    launchctl_unload:
        Image: '/bin/launchctl'
        CommandLine|contains: 'unload'
    security_plists:
        CommandLine|contains:
            - 'com.objective-see.lulu.plist'
            - 'com.objective-see.blockblock.plist'
            - 'com.google.santad.plist'
            - 'com.carbonblack.defense.daemon.plist'
            - 'com.carbonblack.daemon.plist'
            - 'at.obdev.littlesnitchd.plist'
            - 'com.tenablesecurity.nessusagent.plist'
            - 'com.opendns.osx.RoamingClientConfigUpdater.plist'
            - 'com.crowdstrike.falcond.plist'
            - 'com.crowdstrike.userdaemon.plist'
            - 'osquery'
            - 'filebeat'
            - 'auditbeat'
            - 'packetbeat'
            - 'td-agent'
    disable_gatekeeper:
        Image: '/usr/sbin/spctl'
        CommandLine|contains: 'disable'
    condition: (launchctl_unload and security_plists) or disable_gatekeeper
falsepositives:
    - Unknown
level: medium