{
  "family": "disabler",
  "sample_count": 10,
  "category": "ransomware",
  "description": "Trojan:Win32/Disabler (or generic **Disabler** heuristics) represents a critical class of malware specifically engineered to actively hunt, cripple, and terminate endpoint security software (Antivirus, EDR, Windows Defender) prior to the execution of a primary payload (like ransomware or a rootkit). Disablers act as the vanguard of a sophisticated attack, 'clearing the path' so the subsequent malware can operate undetected.<br><br><b>Understanding Disabler Malware</b><br>To an end-user, the infection might manifest as a sudden, unexplained red 'X' on their antivirus icon, or a failure to open the Windows Security Center. For a security analyst, a Disabler alert is an emergency. If a Disabler successfully executes, the endpoint is completely blind and defenseless. Modern ransomware (like LockBit or Conti) heavily relies on custom Disabler modules (often leveraging BYOVD - Bring Your Own Vulnerable Driver techniques) to bypass enterprise EDR.<br><br><b>Execution and Impairment Mechanics</b><br>A Disabler is typically dropped by an Initial Access Broker trojan (`T1105`). Upon execution (`T1204.002`), it attempts to escalate privileges to `SYSTEM`. Once achieved, it employs multiple techniques to blind the endpoint (`T1562.001`). It will forcefully terminate the processes of known security vendors (e.g., `MsMpEng.exe` for Defender). It modifies the Windows Registry to disable real-time protection, tamper protection, and cloud-delivered protection. Advanced Disablers will load a vulnerable, signed driver (BYOVD) to gain kernel-level (`Ring 0`) access, allowing them to forcefully unload the kernel-mode drivers used by EDR solutions to monitor process creation and memory injection.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the complete loss of endpoint visibility and protection, almost always followed immediately by a severe compromise. The primary IoC is an avalanche of EDR 'Tamper Protection' alerts, followed by the EDR sensor suddenly dropping offline. System logs (`Event ID 7036`) will show the unexpected termination of the Antivirus service. Analysts should look for the dropping of unexpected `.sys` files (drivers) in the `C:\\Windows\\System32\\drivers` directory.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1562.001",
    "T1112",
    "T1489",
    "T1068"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Terminating AV/EDR)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1068",
      "name": "Exploitation for Privilege Escalation (BYOVD Attacks)",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1112",
      "name": "Modify Registry (Disabling Defender settings via Policy)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1489",
      "name": "Service Stop (Forcefully stopping AV services)",
      "tactic": "Impact"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network; if a Disabler is active, a ransomware deployment is likely imminent.",
    "Do not rely on the local EDR agent for containment if the Disabler was successful; isolate the machine at the switch/firewall level.",
    "Capture a memory dump (RAM) immediately. The Disabler module and the subsequent payload are likely active in memory even if the EDR is blind.",
    "Perform a deep forensic review to identify the vulnerable driver (BYOVD) used to bypass kernel protections and block its hash enterprise-wide."
  ],
  "what_to_avoid": [
    "Do NOT assume the endpoint is safe if you simply restart the antivirus service; the malware maintains persistence and will disable it again.",
    "Avoid relying solely on automated remediation; a successful Disabler means the automated tools have been compromised."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}