Security Tooling Tampering (T1562.001) in Amatera ClickFix Chain

Arnold Chan@slaz

•updated Sep 5, 2026•2•0•2

Detects attempts to modify, disable, or exclude paths and processes from Microsoft Defender Antivirus using legitimate administrative utilities such as PowerShell, cmd, sc, and netsh. This behavior is indicative of an adversary attempting to evade security monitoring.