{
  "family": "seeav",
  "sample_count": 1,
  "category": "ransomware",
  "description": "Trojan:Win32/Seeav is a generic detection indicating that a malicious binary is actively attempting to Impair Defenses by seeking out and neutralizing the host's antivirus (AV) or Endpoint Detection and Response (EDR) software (`T1562.001`). This is not a standalone payload, but rather a precursor behavior—the malware is 'clearing the room' before dropping a highly destructive payload like ransomware.<br><br><b>Understanding Seeav (Defense Evasion)</b><br>To an end-user, the Windows Security Center might suddenly display a red 'x', or the AV icon might disappear from the system tray. For a SOC analyst, a 'Seeav' detection is a critical, high-priority alert. It means an attacker has gained execution on a host and is currently engaged in a dogfight with your primary security controls.<br><br><b>Execution and Neutralization Mechanics</b><br>Malware exhibiting Seeav behavior uses several techniques to blind defenders. If it lacks administrative privileges, it might simply attempt to terminate the GUI processes of known AV vendors. If it has SYSTEM privileges, it is far more dangerous: it will attempt to stop AV services (e.g., `net stop WinDefend`), unload AV kernel drivers, or modify the Windows Registry to disable real-time protection (`HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender`). Advanced variants utilize 'Bring Your Own Vulnerable Driver' (BYOVD) techniques, dropping a legitimately signed (but vulnerable) driver to execute code in the kernel space specifically to kill EDR processes.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the total blinding of security visibility on the endpoint. Host-based IoCs include EDR telemetry showing a process attempting to modify registry keys associated with Windows Defender or other AV products, or commands like `sc stop` targeting security services. Another strong IoC is the sudden, unexplained cessation of log ingestion from a specific endpoint to the SIEM.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1562.006",
    "T1068",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (The core behavior of shutting down AV/EDR)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.006",
      "name": "Impair Defenses: Indicator Blocking (Modifying host firewalls to block EDR telemetry)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1068",
      "name": "Exploitation for Privilege Escalation (Often required to successfully stop kernel-level security tools)",
      "tactic": "Privilege Escalation"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately; if the malware is attempting to kill the AV, a severe payload (like ransomware) is imminent.",
    "Assume the endpoint's local security logs can no longer be trusted, as the malware may have tampered with them.",
    "Investigate how the malware obtained the administrative or SYSTEM privileges required to disable the AV engine.",
    "Deploy a secondary, out-of-band scanner (like a forensic live disk) to identify the payload that the Seeav behavior was protecting."
  ],
  "what_to_avoid": [
    "Do not ignore alerts about AV services stopping unexpectedly; this is rarely a benign system glitch.",
    "Avoid simply restarting the AV service and closing the ticket; you must find and remove the malware that killed it."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}