BeepRAT Defense Evasion: Security Tool Tampering and Log Clearing (T1562)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects attempts to disable or tamper with Windows security products and logging mechanisms. This includes stopping security services, clearing event logs, using PowerShell to modify security preferences (e.g., Windows Defender exclusions or real-time monitoring), and modifying registry keys to disable security features.