TA0112 / Enterprise tactic
Defense Impairment
Official MITRE tacticThe adversary is trying to break security mechanisms, pipelines, and tooling so defenders can’t see or trust what’s happening.
Defense Impairment consists of techniques that degrade, disable, or undermine the effectiveness and trustworthiness of security controls and monitoring mechanisms. These techniques are characterized by direct interference with defensive systems. The goal is to reduce defenders’ ability to detect, interpret, or respond to adversary activity.
18 techniques
- T1686Disable or Modify System Firewall3 sub-techniques
- T1685Disable or Modify Tools7 sub-techniques
- T1484Domain or Tenant Policy Modification2 sub-techniques
- T1689Downgrade Attack
- T1687Exploitation for Defense Impairment
- T1222File and Directory Permissions Modification2 sub-techniques
- T1556Modify Authentication Process9 sub-techniques
- T1578Modify Cloud Compute Infrastructure5 sub-techniques
- T1666Modify Cloud Resource Hierarchy
- T1112Modify Registry
- T1601Modify System Image2 sub-techniques
- T1599Network Boundary Bridging1 sub-techniques
- T1647Plist File Modification
- T1690Prevent Command History Logging
- T1207Rogue Domain Controller
- T1688Safe Mode Boot
- T1553Subvert Trust Controls6 sub-techniques
- T1600Weaken Encryption2 sub-techniques