MITRE ATT&CKtactic

TA0112 Defense Impairment

Published 2026-04-14 Modified 2026-05-12 Official page ↗
Domain
enterprise
Version
1.0
Created
2026-04-14

Description

The adversary is trying to break security mechanisms, pipelines, and tooling so defenders can’t see or trust what’s happening. Defense Impairment consists of techniques that degrade, disable, or undermine the effectiveness and trustworthiness of security controls and monitoring mechanisms. These techniques are characterized by direct interference with defensive systems. The goal is to reduce defenders’ ability to detect, interpret, or respond to adversary activity.

Related

Referenced by MITRE ATT&CK · tactic (57)

  • T1685.007 Impair Autonomous Defenses sub-technique
  • T1685 Disable or Modify Tools technique
  • T1685.001 Disable or Modify Windows Event Log sub-technique
  • T1685.002 Disable or Modify Cloud Log sub-technique
  • T1685.003 Modify or Spoof Tool UI sub-technique
  • T1685.004 Disable or Modify Linux Audit System Log sub-technique
  • T1685.005 Clear Windows Event Logs sub-technique
  • T1685.006 Clear Linux or Mac System Logs sub-technique
  • T1686 Disable or Modify System Firewall technique
  • T1686.001 Cloud Firewall sub-technique
  • T1686.002 Network Device Firewall sub-technique
  • T1686.003 Windows Host Firewall sub-technique
  • T1687 Exploitation for Defense Impairment technique
  • T1688 Safe Mode Boot technique
  • T1689 Downgrade Attack technique
  • T1690 Prevent Command History Logging technique
  • T1666 Modify Cloud Resource Hierarchy technique
  • T1556.009 Conditional Access Policies sub-technique
  • T1578.005 Modify Cloud Compute Configurations sub-technique
  • T1556.008 Network Provider DLL sub-technique
  • T1556.007 Hybrid Identity sub-technique
  • T1556.006 Multi-Factor Authentication sub-technique
  • T1647 Plist File Modification technique
  • T1556.005 Reversible Encryption sub-technique
  • T1553.006 Code Signing Policy Modification sub-technique
  • T1553.005 Mark-of-the-Web Bypass sub-technique
  • T1484.001 Group Policy Modification sub-technique
  • T1484.002 Trust Modification sub-technique
  • T1556.004 Network Device Authentication sub-technique
  • T1599 Network Boundary Bridging technique
Show all 57 ›