T1562

Impair Defenses

Description

Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. This may also span both native defenses as well as supplemental capabilities installed by users and administrators. Adversaries may also impair routine operations that contribute to defensive hygiene, such as blocking users from logging out, preventing a system from shutting down, or disabling or modifying the update process. Adversaries could also target event aggregation and analysis mechanisms, or otherwise disrupt these procedures by altering other system components. These restrictions can further enable malicious operations as well as the continued propagation of incidents.(Citation: Google Cloud Mandiant UNC3886 2024)(Citation: Emotet shutdown)

Mapped SPARTA techniques

20 techniques

DE-0001 Disable Fault ManagementST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0002 Disrupt or Deceive DownlinkST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0002.01 Inhibit Ground System FunctionalityST0006
addresses
high
Inhibiting ground-system functionality (taking down telemetry processing, command sequencing, or monitoring tools) impairs the operator's defensive posture — direct match for T1562 'Impair Defenses'.
DE-0002.03 Inhibit Spacecraft FunctionalityST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003 On-Board Values ObfuscationST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.01 Vehicle Command Counter (VCC)ST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.02 Rejected Command CounterST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.03 Command Receiver On/Off ModeST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.04 Command Receivers Received Signal StrengthST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.05 Command Receiver Lock ModesST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.06 Telemetry Downlink ModesST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.07 Cryptographic ModesST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.08 Received CommandsST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.09 System Clock for EvasionST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.10 GPS EphemerisST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.11 Watchdog Timer (WDT) for EvasionST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0003.12 Poison AI/ML Training for EvasionST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0009.04 Targeted Deception of Onboard SSA/SDA SensorsST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
DE-0009.05 Corruption or Overload of Ground-Based SDA SystemsST0006
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.
EX-0006 Disable/Bypass EncryptionST0004
relates to
moderate
Mapped by SPARTA, not curated by SafeMode Space.

Cite as SafeMode Space, mitre-attack-enterprise T1562.

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.

# Description

›Mapped SPARTA techniques

20 techniques

Description

Mapped SPARTA techniques