Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. This may also span both native defenses as well as supplemental capabilities installed by users and administrators.
Adversaries may also impair routine operations that contribute to defensive hygiene, such as blocking users from logging out, preventing a system from shutting down, or disabling or modifying the update process. Adversaries could also target event aggregation and analysis mechanisms, or otherwise disrupt these procedures by altering other system components. These restrictions can further enable malicious operations as well as the continued propagation of incidents.(Citation: Google Cloud Mandiant UNC3886 2024)(Citation: Emotet shutdown)
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| action.hacking.variety.Disable controls | Disable or interfere with security controls | related-to | T1562 | Impair Defenses | |
| action.hacking.variety.Evade Defenses | Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. | related-to | T1562 | Impair Defenses | |
| action.malware.variety.Disable controls | Disable or interfere with security controls | related-to | T1562 | Impair Defenses | |
| action.malware.variety.Evade Defenses | Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. | related-to | T1562 | Impair Defenses | |
| action.malware.variety.Modify data | Malware which compromises a legitimate file rather than creating new filess | related-to | T1562 | Impair Defenses | |
| action.social.variety.Evade Defenses | Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. | related-to | T1562 | Impair Defenses | |
| amazon_guardduty | Amazon GuardDuty | technique_scores | T1562 | Impair Defenses |
Comments
GuardDuty flags the following finding type DefenseEvasion:IAMUser/AnomalousBehavior as a defense evasion technique. It looks for API calls that delete, disable, or stop operations, such as, DeleteFlowLogs, DisableAlarmActions, or StopLogging. The following Finding types are examples:
Stealth:IAMUser/CloudTrailLoggingDisabled Stealth:IAMUser/PasswordPolicyChange Stealth:S3/ServerAccessLoggingDisabled
References
|
| amazon_inspector | Amazon Inspector | technique_scores | T1562 | Impair Defenses |
Comments
The Amazon Inspector Best Practices assessment package can assess security control "Configure permissions for system directories" that prevents privilege escalation by local users and ensures only the root account can modify/execute system configuration information and binaries. Amazon Inspector does not directly protect against system modifications rather it just checks to see if security controls are in place which can inform decisions around hardening the system. Furthermore, Amazon Inspector only supports a subset of the sub-techniques for this technique. Due to these things and the fact the security control is only supported for Linux platforms, the score is Minimal.
References
|
| aws_config | AWS Config | technique_scores | T1562 | Impair Defenses |
Comments
This control provides significant coverage for a minority of this technique's sub-techniques, resulting in an overall score of Minimal. "Detect the use of insecure network services and protocols with known security weaknesses"
References
|
| aws_iot_device_defender | AWS IoT Device Defender | technique_scores | T1562 | Impair Defenses |
Comments
This control provides partial coverage for a minority of this technique's sub-techniques, resulting in an overall score of Minimal. "plan the appropriate remediation to prevent unauthorized device access or data disclosure."
References
|
| aws_iot_device_defender | AWS IoT Device Defender | technique_scores | T1562 | Impair Defenses |
Comments
This control provides partial coverage for a minority of this technique's sub-techniques, resulting in an overall score of Minimal. "you can continuously ingest and evaluate message size data, which can point to issues such as credential abuse."
References
|
| aws_security_hub | AWS Security Hub | technique_scores | T1562 | Impair Defenses |
Comments
AWS Security Hub performs checks from the AWS Foundations CIS Benchmark that, if implemented, would help towards detecting changes to key AWS services. AWS Security Hub provides these detections with the following checks.
3.5 Ensure a log metric filter and alarm exist for CloudTrail configuration changes 3.9 Ensure a log metric filter and alarm exist for AWS Config configuration changes 3.10 Ensure a log metric filter and alarm exist for security group changes 3.11 Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL) 3.12 Ensure a log metric filter and alarm exist for changes to network gateways 3.13 Ensure a log metric filter and alarm exist for route table changes 3.14 Ensure a log metric filter and alarm exist for VPC changes
This is scored as Partial because it only supports a subset of the sub-techniques (3 of 8).
References
|