T1562: Impair Defenses

View on MITRE ATT&CK T1562
Tactic(s) Defense Evasion

Data from MITRE ATT&CK®:

Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. This may also span both native defenses as well as supplemental capabilities installed by users and administrators.

Adversaries may also impair routine operations that contribute to defensive hygiene, such as blocking users from logging out of a computer or stopping it from being shut down. These restrictions can further enable malicious operations as well as the continued propagation of incidents.(Citation: Emotet shutdown)

Adversaries could also target event aggregation and analysis mechanisms, or otherwise disrupt these procedures by altering other system components.

© 2024 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

Cyber Threat Graph Context

Explore how this ATT&CK Technique relates to the wider threat graph

Reporting on this Technique

Report

Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day

Reporting from Mandiant which discusses the exploitation of Pulse Secure VPN devices in 2021 and 12 malware families associated with the campaign. ...

View Source
Report

APT40 Advisory - PRC MSS tradecraft in action

This advisory, authored by the Australian Cyber Security Centre and multiple other international cybersecurity agencies, outlines the threat posed ...

View Source
Report

ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices

This blog post from Cisco Talos discusses ArcaneDoor, an espionage-focused campaign targeting perimeter network devices, which are crucial for ...

View Source
Report

People's Republic of China-Linked Cyber Actors Hide in Router Firmware

This Cybersecurity Advisory from CISA and partners details activities of the People's Republic of China (PRC)-linked cyber actors known as ...

View Source
Report

StopRansomware: Phobos Ransomware

This is a joint Cybersecurity Advisory produced by CISA, the FBI and the Multi-State Information Sharing and Analysis Center (MS-ISAC). It ...

View Source
Report

Threat Actor Groups, Including Black Basta, are Exploiting Recent ScreenConnect Vulnerabilities

This blog post gives a detailed analysis of two critical vulnerabilities (CVE-2024-1708 and CVE-2024-1709) affecting ConnectWise ScreenConnect ...

View Source

Mitigations for this technique

MITRE ATT&CK Mitigations

How to detect this technique

MITRE ATT&CK Data Components

Control Validation Tests for this Technique

Use Atomic Red Team tests to test your defenses against this technique.

Sigma Detections for this Technique

SP800-53 Controls

See which controls can help protect against this MITRE ATT&CK technique. This is based on mappings to associated SP800-53 controls produced by the MITRE Engenuity Center for Threat-Informed Defense.

Node
AC-5: Separation of Duties
CA-8: Penetration Testing
CM-5: Access Restrictions for Change
SI-3: Malicious Code Protection
CM-6: Configuration Settings
IA-2: Identification and Authentication (organizational Users)
CM-7: Least Functionality
AC-6: Least Privilege
CA-7: Continuous Monitoring
SI-4: System Monitoring
SI-7: Software, Firmware, and Information Integrity
IA-4: Identifier Management
AC-3: Access Enforcement
RA-5: Vulnerability Monitoring and Scanning
AC-2: Account Management
CM-2: Baseline Configuration