t1562-impair-defenses

name	T1562_impair-defenses
description	Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1562","defense-evasion","windows","iaas","linux","macos","containers","network-devices","identity-provider","office-suite","esxi"]
technique_id	T1562
tactic	defense-evasion
all_tactics	["defense-evasion"]
platforms	["Windows","IaaS","Linux","macOS","Containers","Network Devices","Identity Provider","Office Suite","ESXi"]
mitre_url	https://attack.mitre.org/techniques/T1562
tech_stack	["windows","cloud","linux","macos","containers","network devices","identity","office","esxi"]
cwe_ids	["CWE-693"]
chains_with	["T1562.001","T1562.002","T1562.003","T1562.004","T1562.006","T1562.007","T1562.008","T1562.009","T1562.010","T1562.011","T1562.012","T1562.013"]
prerequisites	[]
severity_boost	{"T1562.001":"Chain with T1562.001 for deeper attack path","T1562.002":"Chain with T1562.002 for deeper attack path","T1562.003":"Chain with T1562.003 for deeper attack path"}

T1562 Impair Defenses

High-Level Description

Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. This may also span both native defenses as well as supplemental capabilities installed by users and administrators.

Adversaries may also impair routine operations that contribute to defensive hygiene, such as blocking users from logging out, preventing a system from shutting down, or disabling or modifying the update process. Adversaries could also target event aggregation and analysis mechanisms, or otherwise disrupt these procedures by altering other system components. These restrictions can further enable malicious operations as well as the continued propagation of incidents.

Kill Chain Phase

• Defense Evasion (TA0005)

Platforms: Windows, IaaS, Linux, macOS, Containers, Network Devices, Identity Provider, Office Suite, ESXi

What to Check

• Identify if Impair Defenses technique is applicable to target environment
• Check Windows systems for indicators of Impair Defenses
• Check IaaS systems for indicators of Impair Defenses
• Check Linux systems for indicators of Impair Defenses
• Verify mitigations are bypassed or absent (7 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Windows Disable LSA Protection

The following Atomic adds a registry entry to disable LSA Protection.

The LSA controls and manages user rights information, password hashes and other important bits of information in memory. Attacker tools, such as mimikatz, rely on accessing this content to scrape password hashes or clear-text passwords. Enabling LSA Protection configures Windows to control the information stored in memory in a more secure fashion - specifically, to prevent non-protected processes from accessing that data. Upon successful execution, the registry will be modified and RunAsPPL will be set to 0, disabling Lsass protection.