Campaign Advisory — Not a CVE. TTP alert: attackers observed systematically disabling security tooling as a pre-credential-dumping kill chain step.
Technique: Defense Suppression → Credential Dumping | Targets: Microsoft Defender, Sysmon, WAF | Tooling: Mimikatz
What Is Happening
Threat actors have been observed executing a systematic defense suppression chain: after gaining initial access, they disable Microsoft Defender (Windows built-in antivirus), Sysmon (system monitoring), and Web Application Firewalls before dumping credentials with Mimikatz. This is a sophisticated pre-credential-access kill chain that strips away security visibility before the highest-impact action. The timing is particularly alarming: this week alone has seen two separate Microsoft Defender vulnerabilities (BlueHammer ransomware CVE-2026-33825, RoguePlanet 0-day) and now a campaign that explicitly targets Defender as step one.
Technique Detail
The attack chain: Initial Access → Privilege Escalation (if needed) → Disable Defender (stop service, modify registry, unload driver) → Disable Sysmon (stop service, delete configuration) → Disable WAF (modify rules, bypass protections) → Dump credentials with Mimikatz → Lateral movement with harvested credentials.
Detections and Mitigations
- Enable Defender Tamper Protection. This prevents unauthorised changes to Defender settings, including service stoppage. Verify enabled via Security Center or Group Policy.
- Monitor for security service state changes. Alert on Event ID 7045 (service stop) for WinDefend, Sysmon, and WAF services. Alert on registry modifications to HKLM\SOFTWARE\Microsoft\Windows Defender\DisableAntiSpyware.
- Sysmon configuration hardening. Ensure Sysmon configuration is managed via Group Policy and cannot be modified without administrative access.
- WAF bypass detection. Monitor for unexpected WAF rule modifications or disabled protections.
- Credential dumping detection. Alert on lsass.exe access, Event ID 4663 (access to LSASS), and known Mimikatz signatures.
- Apply all Defender patches. BlueHammer (April) and RoguePlanet (pending) — ensure Defender is fully updated.
References
TTP advisory. Part of the Vulnerability Intelligence series. See the July 2, 2026 VIR.
