Defense Impairment (18 techniques)
Degrading, disabling, or undermining security controls and monitoring so defenders cannot see or trust what is happening.
The Defense Impairment tactic groups MITRE ATT&CK techniques used by adversaries todegrading, disabling, or undermining security controls and monitoring so defenders cannot see or trust what is happening. Each technique below has its own page with detection guidance, platforms, and sub-techniques.
- T1112 - Modify RegistryWindows
- T1207 - Rogue Domain ControllerWindows
- T1222 - File and Directory Permissions ModificationESXi, Linux, macOS, Windows
- T1484 - Domain or Tenant Policy ModificationWindows, Identity Provider
- T1553 - Subvert Trust ControlsLinux, macOS, Windows
- T1556 - Modify Authentication ProcessIaaS, Identity Provider, Linux, macOS, Network Devices, Office Suite, SaaS, Windows
- T1578 - Modify Cloud Compute InfrastructureIaaS
- T1599 - Network Boundary BridgingNetwork Devices
- T1600 - Weaken EncryptionNetwork Devices
- T1601 - Modify System ImageNetwork Devices
- T1647 - Plist File ModificationmacOS
- T1666 - Modify Cloud Resource HierarchyIaaS
- T1685 - Disable or Modify ToolsContainers, ESXi, IaaS, Linux, macOS, Network Devices, Windows
- T1686 - Disable or Modify System FirewallESXi, Linux, macOS, Network Devices, Windows
- T1687 - Exploitation for Defense ImpairmentIaaS, Linux, macOS, SaaS, Windows
- T1688 - Safe Mode BootWindows
- T1689 - Downgrade AttackmacOS, Windows, Linux
- T1690 - Prevent Command History LoggingESXi, Linux, macOS, Network Devices, Windows
Detection engineering training, taught by practitioners.
Learn how to build real detections across the MITRE ATT&CK framework.
View Courses