T1562

Official Description

Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. This may also span both native defenses as well as supplemental capabilities installed by users and administrators.

Adversaries may also impair routine operations that contribute to defensive hygiene, such as blocking users from logging out, preventing a system from shutting down, or disabling or modifying the update process. Adversaries could also target event aggregation and analysis mechanisms, or otherwise disrupt these procedures by altering other system components. These restrictions can further enable malicious operations as well as the continued propagation of incidents.(Citation: Google Cloud Mandiant UNC3886 2024)(Citation: Emotet shutdown)

Tactics: Stealth
Platforms: Windows, IaaS, Linux, macOS, Containers, Network Devices, Identity Provider, Office Suite, ESXi
MITRE Version: 1.7
Last Modified: Apr 14, 2026

View on MITRE ATT&CK ↗

Reported Context (5)

The appendix maps the “AWS web ACL deletion” alert to this technique. Researchers Map AWS Identity Behavior to Improve Cloud Threat Detection
Avoidance of EDR visibility through native tooling and low-noise operations is mapped to this technique. Report Details State-Linked Cyber Threats to Water Systems
The report maps operating outside enterprise EDR visibility to Impair Defenses. Report Details Russian Router Hijacking and Messaging-Account Operations
The skimmer sets a Google Analytics opt-out flag to suppress analytics collection on the checkout page. WooCommerce Skimmer Mimics Stripe Checkout to Steal Payment Card Data
The stager patches AMSI by writing to amsiContext, and disables SSL certificate validation. Fake Claude Code Install Pages Deliver Multi-Stage Malware

Malware (1)

People (4)

Threat Actors (10)

MITRE ATT&CK (58)

Vendors (6)

Products (28)

Tools (9)

Industries (12)

Countries (12)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.