Cross-source coverage
T1562 / ATT&CK
Impair Defenses
ATT&CK has retired this technique. Rules still tag it; the current id is T1685 Disable or Modify Tools.
484 rules · 475 families across 9 sources.
3 deprecated hidden · include
From MITRE ATT&CK 19.2
Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. This may also span both native defenses as well as supplemental capabilities installed by users and administrators.
Adversaries may also impair routine operations that contribute to defensive hygiene, such as blocking users from logging out, preventing a system from shutting down, or disabling or modifying the update process. Adversaries could also target event aggregation and analysis mechanisms, or otherwise disrupt these procedures by altering other system components. These restrictions can further enable malicious operations as well as the continued propagation of incidents.
- Tactics
- Stealth
- Platforms
- Windows · IaaS · Linux · macOS · Containers · Network Devices · Identity Provider · Office Suite · ESXi
- Telemetry
- —
Sub-techniques with coverage
Counted in the 484 above — a rule tagged a sub-technique covers this technique too.
- T1562.001 Disable or Modify Tools 207
- T1562.008 Disable or Modify Cloud Logs 60
- T1562.007 Disable or Modify Cloud Firewall 33
- T1562.004 Disable or Modify System Firewall 26
- T1562.006 Indicator Blocking 13
- T1562.003 Impair Command History Logging 9
- T1562.010 Downgrade Attack 6
- T1562.002 Disable Windows Event Logging 5
- T1562.012 Disable or Modify Linux Audit System 2
elastic/detection-rules
154 rules| Detection | Severity | Format |
|---|---|---|
| Attempt to Clear Kernel Ring Buffer | High | Elastic TOML |
| Attempt to Unload Elastic Endpoint Security Kernel Extension | High | Elastic TOML |
| AWS Backup Vault Deleted or Vault Lock Removed | High | Elastic TOML |
| AWS Bedrock API Key Used for Destructive or Anti-Recovery Action | High | Elastic TOML |
| AWS Bedrock Model Invocation Logging Disabled or Modified | High | Elastic TOML |
| AWS CloudTrail Log Suspended | High | Elastic TOML |
| AWS CloudTrail Log Updated | High | Elastic TOML |
| AWS Configuration Recorder Stopped | High | Elastic TOML |
| AWS EC2 Serial Console Access Enabled | High | Elastic TOML |
| AWS EKS Control Plane Logging Disabled | High | Elastic TOML |
+ 144 more from elastic/detection-rules → showing the 10 highest-severity
panther-labs/panther-analysis
92 rules| Detection | Severity | Format |
|---|---|---|
| AWS RDS Instance Modified to be Publicly Accessible | Critical | Panther Python |
| AWS WAF Disassociation | Critical | Panther Python |
| GitHub Advanced Security Change WITHOUT Repo Archived | Critical | Panther Python |
| Slack Microsoft Intune Mobile Device Management Disabled | Critical | Panther Python |
| Anthropic IP Restriction Deleted | High | Panther Python |
| Anthropic SSO Disabled | High | Panther Python |
| Auth0 Attack Protection Monitoring Disabled | High | Panther Python |
| Auth0 Bot Detection Policy Disabled | High | Panther Python |
| AWS RDS Activity Stream Stopped | High | Panther Python |
| AWS RDS Deletion Protection Disabled | High | Panther Python |
+ 82 more from panther-labs/panther-analysis → showing the 10 highest-severity
socfortress/Wazuh-Rules
72 rules · 69 families+ 62 more from socfortress/Wazuh-Rules → showing the 10 highest-severity
elastic/protections-artifacts
56 rules| Detection | Severity | Format |
|---|---|---|
| AllowProtectedRenames Registry Modification | Undefined | Elastic TOML |
| AMSI Bypass from Suspicious Module | Undefined | Elastic TOML |
| AMSI Bypass via COM Registry Modification | Undefined | Elastic TOML |
| AMSI Bypass via PowerShell | Undefined | Elastic TOML |
| AMSI Bypass via Unbacked Memory | Undefined | Elastic TOML |
| AMSI or WLDP Bypass via Memory Patching | Undefined | Elastic TOML |
| Attempt to Clear Kernel Ring Buffer via Dmesg | Undefined | Elastic TOML |
| Attempt to Clear Logs via Journalctl | Undefined | Elastic TOML |
| Attempt to Disable Auditd Service | Undefined | Elastic TOML |
| Attempt to Disable SELinux | Undefined | Elastic TOML |
+ 46 more from elastic/protections-artifacts → showing the 10 highest-severity
chronicle/detection-rules
36 rules| Detection | Severity | Format |
|---|---|---|
| o365_logging_disabled | Critical | YARA-L |
| o365_logging_enabled | Critical | YARA-L |
| sap_deactivation_of_security_audit_log | Critical | YARA-L |
| sap_hanadb_deactivation_of_audit_trail | Critical | YARA-L |
| aws_cloudtrail_logging_tampered | High | YARA-L |
| aws_config_service_modified | High | YARA-L |
| aws_delete_cloudwatch_log_group | High | YARA-L |
| aws_guardduty_disabled | High | YARA-L |
| aws_guardduty_publishing_destination_deleted | High | YARA-L |
| aws_guardduty_trusted_or_threat_ip_lists_tampered | High | YARA-L |
+ 26 more from chronicle/detection-rules → showing the 10 highest-severity
Wazuh Core Ruleset
35 rules| Detection | Severity | Format |
|---|---|---|
| Microsoft Active Protection Service (MAPS) was disabled by Powershell command | Critical | Wazuh XML |
| Netsh used to add firewall rule referencing port 5900, usually used for VNC | Critical | Wazuh XML |
| Windows Defender Controlled folder access was disabled by Powershell command | Critical | Wazuh XML |
| Windows Defender downloaded file scanning was disabled by Powershell command | Critical | Wazuh XML |
| Windows Defender Intrusion prevention system was disabled by Powershell command | Critical | Wazuh XML |
| Windows Defender network protection was disabled by Powershell command | Critical | Wazuh XML |
| Windows Defender sample submit was disabled by Powershell command | Critical | Wazuh XML |
| Windows Defender script scanning was disabled by Powershell command | Critical | Wazuh XML |
| Netsh used to add firewall rule | High | Wazuh XML |
| Possible disruption of CloudTrail Logging: Management events logging disabled with an event selector. | High | Wazuh XML |
+ 25 more from Wazuh Core Ruleset → showing the 10 highest-severity
Azure/Azure-Sentinel
26 rules| Detection | Severity | Format |
|---|---|---|
| Security Service Registry ACL Modification | High | KQL |
| Azure Diagnostic settings removed from a resource | Medium | KQL |
| AI Agents - Missing Tools in Instructions | Undefined | KQL |
| AI Agents - Orphaned Agents with Disabled Owners | Undefined | KQL |
| AI Agents - Published Agents without Instructions | Undefined | KQL |
| AI Agents - Published Agents with Short Instructions | Undefined | KQL |
| Anomalous .NET runtime loading for fileless payload | Undefined | KQL |
| ATP policy status check | Undefined | KQL |
| Changes to Blocked Teams Domains | Undefined | KQL |
| Changes to Blocked Teams Domains (NRT) | Undefined | KQL |
+ 16 more from Azure/Azure-Sentinel → showing the 10 highest-severity
Bert-JanP/Hunting-Queries-Detection-Rules
11 rules| Detection | Severity | Format |
|---|---|---|
| Advanced Feature Disabled | Undefined | KQL |
| Defender AV Exclusion Events | Undefined | KQL |
| Defender For Endpoint Offboarding Package Downloaded | Undefined | KQL |
| Large Number of Analytics Rules Deleted | Undefined | KQL |
| List Alert Supression Actions | Undefined | KQL |
| MITRE ATT&CK Mapping | Undefined | KQL |
| Potential Kerberos Encryption Downgrade | Undefined | KQL |
| *Scattered Spider Defense Evasion via Conditional Access Policies Detection* | Undefined | KQL |
| Sentinel Workspace Disconnected | Undefined | KQL |
| TTP Detection Rule: Abusing PowerShell to disable Defender components | Undefined | KQL |
+ 1 more from Bert-JanP/Hunting-Queries-Detection-Rules → showing the 10 highest-severity
splunk/security_content
2 rules| Detection | Severity | Format |
|---|---|---|
| Cisco IOS XE Log Clearing Sequence With Optional Loopback Removal | Undefined | SPL |
| Cisco IOS XE VTY Access Class Tampering | Undefined | SPL |