Cyber Wiki Learning Path
MITRE ATT&CK®: Defense Impairment
Explore all active Enterprise ATT&CK v19.2 techniques and sub-techniques associated with the Defense Impairment objective, with defensive explanations and linked BMC learning resources.
Recommended Sequence
56 connected entries
Clear Linux or Mac System Logs (T1685.006)
Clear Linux or Mac System Logs (T1685.006) is an Enterprise ATT&CK sub-technique under Disable or Modify Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
ATT&CK sub-technique profile · AdvancedClear Windows Event Logs (T1685.005)
Clear Windows Event Logs (T1685.005) is an Enterprise ATT&CK sub-technique under Disable or Modify Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
ATT&CK sub-technique profile · AdvancedCloud Firewall (T1686.001)
Cloud Firewall (T1686.001) is an Enterprise ATT&CK sub-technique under Disable or Modify System Firewall. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
ATT&CK sub-technique profile · AdvancedCode Signing (T1553.002)
Code Signing (T1553.002) is an Enterprise ATT&CK sub-technique under Subvert Trust Controls. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
ATT&CK sub-technique profile · AdvancedCode Signing Policy Modification (T1553.006)
Code Signing Policy Modification (T1553.006) is an Enterprise ATT&CK sub-technique under Subvert Trust Controls. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
ATT&CK sub-technique profile · AdvancedConditional Access Policies (T1556.009)
Conditional Access Policies (T1556.009) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
ATT&CK sub-technique profile · AdvancedCreate Cloud Instance (T1578.002)
Create Cloud Instance (T1578.002) is an Enterprise ATT&CK sub-technique under Modify Cloud Compute Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
ATT&CK sub-technique profile · AdvancedCreate Snapshot (T1578.001)
Create Snapshot (T1578.001) is an Enterprise ATT&CK sub-technique under Modify Cloud Compute Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
ATT&CK sub-technique profile · AdvancedDelete Cloud Instance (T1578.003)
Delete Cloud Instance (T1578.003) is an Enterprise ATT&CK sub-technique under Modify Cloud Compute Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
ATT&CK sub-technique profile · AdvancedDisable Crypto Hardware (T1600.002)
Disable Crypto Hardware (T1600.002) is an Enterprise ATT&CK sub-technique under Weaken Encryption. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
ATT&CK sub-technique profile · AdvancedDisable or Modify Cloud Log (T1685.002)
Disable or Modify Cloud Log (T1685.002) is an Enterprise ATT&CK sub-technique under Disable or Modify Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
ATT&CK sub-technique profile · AdvancedDisable or Modify Linux Audit System Log (T1685.004)
Disable or Modify Linux Audit System Log (T1685.004) is an Enterprise ATT&CK sub-technique under Disable or Modify Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
ATT&CK technique profile · IntermediateDisable or Modify System Firewall (T1686)
Disable or Modify System Firewall (T1686) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateDisable or Modify Tools (T1685)
Disable or Modify Tools (T1685) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedDisable or Modify Windows Event Log (T1685.001)
Disable or Modify Windows Event Log (T1685.001) is an Enterprise ATT&CK sub-technique under Disable or Modify Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
ATT&CK sub-technique profile · AdvancedDomain Controller Authentication (T1556.001)
Domain Controller Authentication (T1556.001) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
ATT&CK technique profile · IntermediateDomain or Tenant Policy Modification (T1484)
An adversary changes domain, federation, identity-provider, tenant, or cloud policy to weaken controls, grant access, or alter trusted behavior.
ATT&CK technique profile · IntermediateDowngrade Attack (T1689)
Downgrade Attack (T1689) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedDowngrade System Image (T1601.002)
Downgrade System Image (T1601.002) is an Enterprise ATT&CK sub-technique under Modify System Image. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
ATT&CK technique profile · IntermediateExploitation for Defense Impairment (T1687)
Exploitation for Defense Impairment (T1687) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateFile and Directory Permissions Modification (T1222)
File and Directory Permissions Modification (T1222) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedGatekeeper Bypass (T1553.001)
Gatekeeper Bypass (T1553.001) is an Enterprise ATT&CK sub-technique under Subvert Trust Controls. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
ATT&CK sub-technique profile · AdvancedGroup Policy Modification (T1484.001)
Group Policy Modification (T1484.001) is an Enterprise ATT&CK sub-technique under Domain or Tenant Policy Modification. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Privilege Escalation context.
ATT&CK sub-technique profile · AdvancedHybrid Identity (T1556.007)
Hybrid Identity (T1556.007) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
ATT&CK sub-technique profile · AdvancedInstall Root Certificate (T1553.004)
Install Root Certificate (T1553.004) is an Enterprise ATT&CK sub-technique under Subvert Trust Controls. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
ATT&CK sub-technique profile · AdvancedLinux and Mac Permissions (T1222.002)
Linux and Mac Permissions (T1222.002) is an Enterprise ATT&CK sub-technique under File and Directory Permissions Modification. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
ATT&CK sub-technique profile · AdvancedMark-of-the-Web Bypass (T1553.005)
Mark-of-the-Web Bypass (T1553.005) is an Enterprise ATT&CK sub-technique under Subvert Trust Controls. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
ATT&CK technique profile · IntermediateModify Authentication Process (T1556)
Modify Authentication Process (T1556) is an Enterprise ATT&CK technique associated with Defense Impairment, Persistence, Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedModify Cloud Compute Configurations (T1578.005)
Modify Cloud Compute Configurations (T1578.005) is an Enterprise ATT&CK sub-technique under Modify Cloud Compute Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
ATT&CK technique profile · IntermediateModify Cloud Compute Infrastructure (T1578)
Modify Cloud Compute Infrastructure (T1578) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateModify Cloud Resource Hierarchy (T1666)
Modify Cloud Resource Hierarchy (T1666) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateModify Registry (T1112)
Modify Registry (T1112) is an Enterprise ATT&CK technique associated with Defense Impairment, Persistence. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateModify System Image (T1601)
Modify System Image (T1601) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedModify or Spoof Tool UI (T1685.003)
Modify or Spoof Tool UI (T1685.003) is an Enterprise ATT&CK sub-technique under Disable or Modify Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
ATT&CK sub-technique profile · AdvancedMulti-Factor Authentication (T1556.006)
Multi-Factor Authentication (T1556.006) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
ATT&CK sub-technique profile · AdvancedNetwork Address Translation Traversal (T1599.001)
Network Address Translation Traversal (T1599.001) is an Enterprise ATT&CK sub-technique under Network Boundary Bridging. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
ATT&CK technique profile · IntermediateNetwork Boundary Bridging (T1599)
Network Boundary Bridging (T1599) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedNetwork Device Authentication (T1556.004)
Network Device Authentication (T1556.004) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
ATT&CK sub-technique profile · AdvancedNetwork Device Firewall (T1686.002)
Network Device Firewall (T1686.002) is an Enterprise ATT&CK sub-technique under Disable or Modify System Firewall. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
ATT&CK sub-technique profile · AdvancedNetwork Provider DLL (T1556.008)
Network Provider DLL (T1556.008) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
ATT&CK sub-technique profile · AdvancedPassword Filter DLL (T1556.002)
Password Filter DLL (T1556.002) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
ATT&CK sub-technique profile · AdvancedPatch System Image (T1601.001)
Patch System Image (T1601.001) is an Enterprise ATT&CK sub-technique under Modify System Image. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
ATT&CK technique profile · IntermediatePlist File Modification (T1647)
Plist File Modification (T1647) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedPluggable Authentication Modules (T1556.003)
Pluggable Authentication Modules (T1556.003) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
ATT&CK technique profile · IntermediatePrevent Command History Logging (T1690)
Prevent Command History Logging (T1690) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedReduce Key Space (T1600.001)
Reduce Key Space (T1600.001) is an Enterprise ATT&CK sub-technique under Weaken Encryption. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
ATT&CK sub-technique profile · AdvancedReversible Encryption (T1556.005)
Reversible Encryption (T1556.005) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
ATT&CK sub-technique profile · AdvancedRevert Cloud Instance (T1578.004)
Revert Cloud Instance (T1578.004) is an Enterprise ATT&CK sub-technique under Modify Cloud Compute Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
ATT&CK technique profile · IntermediateRogue Domain Controller (T1207)
Rogue Domain Controller (T1207) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedSIP and Trust Provider Hijacking (T1553.003)
SIP and Trust Provider Hijacking (T1553.003) is an Enterprise ATT&CK sub-technique under Subvert Trust Controls. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
ATT&CK technique profile · IntermediateSafe Mode Boot (T1688)
Safe Mode Boot (T1688) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateSubvert Trust Controls (T1553)
Subvert Trust Controls (T1553) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedTrust Modification (T1484.002)
Trust Modification (T1484.002) is an Enterprise ATT&CK sub-technique under Domain or Tenant Policy Modification. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Privilege Escalation context.
ATT&CK technique profile · IntermediateWeaken Encryption (T1600)
Weaken Encryption (T1600) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedWindows Host Firewall (T1686.003)
Windows Host Firewall (T1686.003) is an Enterprise ATT&CK sub-technique under Disable or Modify System Firewall. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
ATT&CK sub-technique profile · AdvancedWindows Permissions (T1222.001)
Windows Permissions (T1222.001) is an Enterprise ATT&CK sub-technique under File and Directory Permissions Modification. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.