Impair Defenses

https://attack.mitre.org/techniques/T1562/

ATT&CK ID: T1562

Description

Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. This may also span both native defenses as well as supplemental capabilities installed by users and administrators.

Adversaries could also target event aggregation and analysis mechanisms, or otherwise disrupt these procedures by altering other system components.

[Source]

Sub-Techniques

T1562.001:

WIP

T1562.002: Disable Windows Event Logging

pageDisable Windows Event Logging

T1562.003: Impair Command History Logging

pageImpair Command History Logging

T1562.004:

pageDisable or Modify System Firewall

T1562.005:

WIP

T1562.006:

WIP

T1562.007:

WIP

T1562.008:

WIP

T1562.009:

WIP

Last updated