CAPECattack pattern
CAPEC-578 Disable Security Software
Medium
Official page ↗
- Abstraction
- Standard
- Status
- Usable
- Likelihood of attack
- Medium
- Typical severity
- Medium
- CAPEC version
- 3.9
Description
An adversary exploits a weakness in access control to disable security tools so that detection does not occur. This can take the form of killing processes, deleting registry keys so that tools do not start at run time, deleting log files, or other methods.
Prerequisites
• The adversary must have the capability to interact with the configuration of the targeted system.
Consequences
• Availability: Hide Activities
Mitigations
• Ensure proper permissions are in place to prevent adversaries from altering the execution status of security tools.
Related
Att&ck technique · MITRE ATT&CK (1)
- T1556.006 Multi-Factor Authentication sub-technique
Child of · CAPEC (1)
- CAPEC-176 Configuration/Environment Manipulation attack pattern
Weakness · CWE (1)
- CWE-284 Improper Access Control weakness
Referenced by CWE · attack pattern (1)
- CWE-284 Improper Access Control weakness