Skip to content

Impair Defenses

Named by 2 kept items in this workspace.

Search every workspace for Impair Defenses. It matches the name as written, so it can find other things that share it.

The items that name it 2

  • Akira Hits Safe Mode: Ransomware Rebooting Around EDR
    writeup2026-08-12It is written here as Impair Defenses: Safe Mode Boot.

    Attacker rebooted the compromised host into Safe Mode with Networking (Kernel-Boot EID 27: SAFEBOOT:NETWORK; Kernel-General EID 12: BootMode = 2) to disable the Huntress agent and Windows Defender real-time protection while preserving network access; first observed use of this technique by Akira.

  • Threat Actor Defense Evasion: How Attackers Disable AV & EDR
    writeup2026-05-18

    MITRE ATT&CK technique under Defense Evasion tactic covering methods to impair, block, and disable endpoint security controls

All techniques in this workspace.