ATT&CK 기법 · Defense Impairment
Disable or Modify Tools T1685
이 기법을 다룬 REVELARE 한국어 위협 분석 1편 · Defense Impairment
이 기법을 다룬 분석
MITRE 공식 정의
Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more br…
플랫폼: Containers, ESXi, IaaS, Linux, macOS, Network Devices, Windows