tfMITRE ATT&CK sub-technique

Modify or Spoof Tool UI T1685.003

sub-technique of T1685 Disable or Modify Tools

Tactic: Defense Impairment
Platforms: Linux, macOS, Windows
Version: 1.0
Created: 14 April 2026
Last modified: 12 May 2026
Contributor: Menachem Goldstein

Adversaries may spoof or manipulate security tool user interfaces (UIs) to falsely indicate tools are functioning normally and delay detection and response.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Modify or Spoof Tool UI MITRE reference T1685.003

44th pctamong all ATT&CK techniques for number of tools

1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

PHASEJAMS9014 ↗

Has prevented legitimate Ivanti Connect Secure system upgrades by intercepting the upgrade command and rendering fake HTML upgrade progress bar through a function called processUpgradeDisplay() which allowed the compromised device to remain under the control of the adversary.1

created 2026-04-16MALWARE

All 1 software entries for this technique

Offense vs defense T1685.003

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Modify or Spoof Tool UI detection strategy DET0311

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection for Spoofing Tool UI across OS Platforms

Enterprise

3 platforms

AN0868 · Windows

Detection of inconsistencies between reported sensor health and actual process/service state. For example, Windows Defender tray icon/UI showing healthy status while corresponding Defender services (WinDefend, MsMpEng) are stopped or disabled. Correlates process creation events with missing or terminated security processes and spoofed health events.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Service CreationDC0060	WinEventLog:System	EventCode=7036

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ServiceNameList	Monitored list of critical security service names; environment-specific.
FakeUIProcessPatterns	Patterns of filenames or paths mimicking Windows Security GUI elements.

AN0869 · Linux

Monitoring for discrepancies between system daemon/service state and reported health messages (e.g., syslog shows AV/IDS daemon stopped, but spoofed messages claim it is still running). Detects userland processes impersonating AV/IDS command-line outputs or modifying log forwarding configurations.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Host StatusDC0018	linux:syslog	Service stop or disable messages for security tools not reflected in SIEM alerts
Process CreationDC0032	auditd:SYSCALL	execve: Execution of binaries/scripts presenting false health messages for security daemons

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SecurityDaemonList	Names of AV/IDS/EDR daemons monitored in Linux environments.

AN0870 · macOS

Detection of fake or spoofed macOS Security & Privacy GUIs showing healthy status after XProtect, Gatekeeper, or AV processes are disabled. Correlates user-space UI process creation with terminated or missing security daemons.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Host StatusDC0018	macos:unifiedlog	Termination or disabling of XProtect, Gatekeeper, or third-party AV daemons
Process CreationDC0032	macos:unifiedlog	Execution of processes mimicking Apple Security & Privacy GUIs

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TrustedDaemonList	Monitored list of macOS security daemons such as XProtect, Gatekeeper, or third-party AV.

Modify or Spoof Tool UI detections T1685.003

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs