Impair Defenses
Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. This may also span both native defenses as well as supplemental capabilities installed by users and administrators. Adversaries may also impair routine operations that contribute to...
BY SOURCE
PROCEDURES (95)
Auto-extracted: 14 detections for general monitoring
Auto-extracted: 7 detections for network connection monitoring
Auto-extracted: 6 detections for api
Auto-extracted: 6 detections for cloud monitoring
Auto-extracted: 6 detections for cloud
Auto-extracted: 5 detections for service
Auto-extracted: 4 detections for script execution monitoring
Auto-extracted: 3 detections for registry
Auto-extracted: 3 detections for authentication monitoring
Auto-extracted: 3 detections for credential
Auto-extracted: 3 detections for phish
Auto-extracted: 3 detections for container
Auto-extracted: 3 detections for c2
Auto-extracted: 3 detections for azure
Auto-extracted: 3 detections for azure
Auto-extracted: 3 detections for evasion
Auto-extracted: 3 detections for persist
Auto-extracted: 3 detections for powershell
Auto-extracted: 3 detections for kernel
Auto-extracted: 2 detections for kubernetes
Auto-extracted: 2 detections for unusual
Auto-extracted: 2 detections for cloud
Auto-extracted: 2 detections for privilege
Auto-extracted: 2 detections for encrypt
Auto-extracted: 2 detections for lateral
Auto-extracted: 2 detections for process creation monitoring
Auto-extracted: 2 detections for privilege
Auto-extracted: 2 detections for aws
Auto-extracted: 2 detections for service
Auto-extracted: 2 detections for event log
Auto-extracted: 2 detections for dns
Auto-extracted: 2 detections for powershell
Auto-extracted: 2 detections for tamper
Auto-extracted: 2 detections for lateral
Auto-extracted: 2 detections for exfiltrat
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for c2
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for email
Auto-extracted: 1 detections for registry
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for attachment
Auto-extracted: 1 detections for token
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for azure
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for download
Auto-extracted: 1 detections for token
Auto-extracted: 1 detections for tamper
Auto-extracted: 1 detections for amsi
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for evasion
Auto-extracted: 1 detections for driver
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for kerbero
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for kernel
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for tamper
Auto-extracted: 1 detections for amsi
Auto-extracted: 1 detections for tamper
Auto-extracted: 1 detections for script block
Auto-extracted: 1 detections for tamper
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for service monitoring
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for encrypt
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for kerbero
Auto-extracted: 1 detections for email security
Auto-extracted: 1 detections for attachment
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for script block
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for script block
Auto-extracted: 1 detections for download
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for driver
Auto-extracted: 1 detections for tamper
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for powershell