CAPEC-578: Disable Security Software
Description
An adversary exploits a weakness in access control to disable security tools so that detection does not occur. This can take the form of killing processes, deleting registry keys so that tools do not start at run time, deleting log files, or other methods.
- Likelihood of attack
- Medium
- Typical severity
- Medium
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Manipulate System Resources
Prerequisites
- The adversary must have the capability to interact with the configuration of the targeted system.
Consequences
- Availability
Hide Activities
By disabling certain security tools, the adversary can hide malicious activity and avoid detection.
Mitigations
- Ensure proper permissions are in place to prevent adversaries from altering the execution status of security tools.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
- T1556.006Modify Authentication Process: Multi-Factor Authentication
- T1562.001Impair Defenses: Disable or Modify Tools
- T1562.002Impair Defenses: Disable Windows Event Logging
- T1562.004Impair Defenses: Disable or Modify System Firewall
- T1562.007Impair Defenses: Disable or Modify Cloud Firewall
- T1562.008Impair Defenses: Disable or Modify Cloud Logs
- T1562.009Impair Defenses: Safe Mode Boot
Across MITRE's defensive frameworks
Linked through the 2 ATT&CK techniques above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-ABPIApplication-based Process Isolation2 shared
- D3-HRHost Reboot2 shared
- D3-HSHost Shutdown2 shared
- D3-KBPIKernel-based Process Isolation2 shared
- D3-PLAProcess Lineage Analysis2 shared
- D3-PSMDProcess Self-Modification Detection2 shared
- D3-PSProcess Suspension2 shared
- D3-PTProcess Termination2 shared
- D3-CIConfiguration Inventory2 shared
- D3-HBPIHardware-based Process Isolation2 shared
- D3-PSAProcess Spawn Analysis2 shared
- D3-RCRestore Configuration2 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2016-04-003User Activity from Stopping Windows Defensive Services1 shared
- CAR-2020-09-003Indicator Blocking - Driver Unloaded1 shared
- CAR-2021-01-007Detecting Tampering of Windows Defender Command Prompt1 shared
- CAR-2022-03-001Disable Windows Event Logging1 shared
- CAR-2013-04-002Quick execution of a series of suspicious commands1 shared