CAPEC-578: Disable Security Software

Description

An adversary exploits a weakness in access control to disable security tools so that detection does not occur. This can take the form of killing processes, deleting registry keys so that tools do not start at run time, deleting log files, or other methods.

Extended Description

In the case of network based reporting of indicators, an adversary may block traffic associated with reporting to prevent central station analysis. This may be accomplished by many means such as stopping a local process to creating a host-based firewall rule to block traffic to a specific server.

In the case of local based reporting of indicators, an adversary may block delivery of locally-generated log files themselves to the central repository.

Severity :

Medium

Possibility :

Medium

Type :

Standard

Relationships with other CAPECs

This table shows the other attack patterns and high level categories that are related to this attack pattern.

CAPEC-176: Configuration/Environment Manipulation Configuration/Environment Manipulation

Prerequisites

This table shows the other attack patterns and high level categories that are related to this attack pattern.

The adversary must have the capability to interact with the configuration of the targeted system.

Skills required

This table shows the other attack patterns and high level categories that are related to this attack pattern.

Taxonomy mappings

Mappings to ATT&CK, OWASP and other frameworks.

ATTACK | Modify Authentication Process: Multi-Factor Authentication ATTACK | Impair Defenses: Disable or Modify Tools ATTACK | Impair Defenses: Disable Windows Event Logging ATTACK | Impair Defenses: Disable or Modify System Firewall ATTACK | Impair Defenses: Disable or Modify Cloud Firewall ATTACK | Impair Defenses: Disable Cloud Logs ATTACK | Impair Defenses: Safe Mode Boot

Resources required

None: No specialized resources are required to execute this type of attack.

Related CWE

A Related Weakness relationship associates a weakness with this attack pattern. Each association implies a weakness that must exist for a given attack to be successful.

CWE-284: Improper Access Control

Visit http://capec.mitre.org/ for more details.