Techniques › T1687
T1687 Exploitation for Defense Impairment
defense impairment — IaaS, Linux, macOS, SaaS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
0
Sigma rules tagged attack.t1687
0
KEV CVEs mapped here
<p>Adversaries may exploit vulnerabilities in security software, infrastructure, or defensive components to degrade, disable, or otherwise continue to impair their ability to prevent, detect, or respond to malicious activity.</p><p>Adversaries may exploit a system or application vulnerability to directly interfere with defensive mechanisms. Exploitation occurs when an adversary takes advantage of a programming error in software, services, or the operating system to execute adversary-controlled code, often with the goal of weakening or disabling protections.</p><p>Vulnerabilities may exist in security tools such as antivirus, endpoint detection and response (EDR), firewalls, or other monitoring solutions. Adversaries may use prior reconnaissance or perform discovery activities (e.g., Software Discovery) to identify defensive tools present in an environment and target them for exploitation.</p><p>Successful exploitation may allow adversaries to terminate security processes, disable protections, bypass enforcement mechanisms, or reduce the effectiveness of defensive controls. In some cases, vulnerabilities in cloud-based or SaaS infrastructure may also be leveraged to bypass built-in security boundaries or disrupt visibility and enforcement across environments.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0900 Detection of Defense Impairment v1.0
AN2038 WindowsDetects suspicious interactions with security products followed by service crashes, unexpected restarts, driver unloads, telemetry gaps, or tamper-state changes. Correlates exploit precursor behavior with immediate degradation of defensive services and follow-on process execution.Tunable:
CrashCorrelationWindowProtectedServiceListTelemetryGapThresholdAN2039 LinuxDetects exploitation attempts against security daemons or kernel security modules followed by daemon termination, disabled logging, module unload, audit stoppage, or reduced endpoint telemetry. Correlates local execution or network input with control degradation.auditd:EXECVEexecve, kill, ptrace, insmod, rmmod targeting security processes→ DC0064 Command ExecutionTunable:ProtectedProcessNamesModuleUnloadAllowlistHealthGapThresholdAN2042 SaaSDetects exploitation or abuse of SaaS security workflows resulting in disabled alerts, reduced retention, bypassed enforcement, role escalation, or tokenized persistence that weakens monitoring. Correlates unusual admin/API activity with visibility reduction.m365:unifiedSet-AdminAuditLogConfig;New-ApplicationAccessPolicy;ConsentToApplication→ DC0038 Application Log ContentTunable:PrivilegedActorAllowlistRetentionChangeThresholdAN2040 macOSDetects crafted activity resulting in crashes or impairment of endpoint security extensions, network filters, launch daemons, or telemetry agents. Correlates process activity, system extension state changes, and telemetry interruption.macos:unifiedlogCrash or abnormal termination of security agent or system extension host→ DC0034 Process MetadataTunable:ExtensionListCrashBurstThresholdAN2041 IaaSDetects exploitation of cloud-native security boundaries or management components followed by disabled logging, detached agents, changed security groups, policy bypass, or telemetry suppression. Correlates suspicious API activity with reduced control coverage.Tunable:CriticalTrailListControlChangeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1687
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.