Impair Defenses

Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities.

Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. Windows event logs record user and system activity such as login attempts, process creation, and much more.

Adversaries may impair command history logging to hide commands they run on a compromised system. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.

Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules.

An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed.

Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources. Cloud firewalls are separate from system firewalls that are described in Disable or Modify System Firewall.

An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection.

Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services.

Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls.

Adversaries may spoof security alerting from tools, presenting false evidence to impair defenders’ awareness of malicious activity.

Adversaries may disable or modify the Linux audit system to hide malicious activity and avoid detection. Linux admins use the Linux Audit system to track security-relevant information on a system.