Impair Defenses
Description
Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This involves impairing preventative defenses and detection capabilities that defenders can use to audit activity and identify malicious behavior. (Citation: MITRE ATT&CK) (Citation: SRC008)
Mapped SPARTA techniques
8 techniques
T1562 'Impair Defenses' is the direct cross-framework counterpart of DE-0001 — both describe maliciously modifying components to hinder/disable defensive mechanisms (in DE-0001's case, FDIR/safing/anomaly detection).
T1562 'Impair Defenses' covers the deception subset of DE-0002 (manipulating telemetry content to suppress alerts and prevent automated/manual mitigations from being initiated based on misleading ground-side information).
T1562 'Impair Defenses' covers disabling/falsifying ground-side telemetry processing — addresses DE-0002.01's corruption of processing pipelines, display crashes, and falsified counter/acknowledgment data.
T1562 'Impair Defenses' covers hindering detection capabilities — addresses DE-0002.03's reduction of telemetry that supports ground-side anomaly detection.
T1562 'Impair Defenses' covers hindering detection capabilities — addresses DE-0003's effect of delaying recognition and degrading audit reconciliation by manipulating the values defenders use to judge command hygiene.
T1562 'Impair Defenses' covers maliciously modifying components to hinder defensive mechanisms — addresses DE-0006's whitelist modification (a defensive mechanism that prevents unknown software execution).
T1562 'Impair Defenses' covers hindering detection capabilities — addresses DE-0009.05's degradation of SDA pipelines (broad-area monitoring is the external decision-support and detection capability).
T1562 'Impair Defenses' is the direct cross-framework counterpart of EX-0006 — both describe maliciously modifying components to hinder/disable defensive mechanisms (in EX-0006's case, encryption protections specifically).
Cite as SafeMode Space, space-shield T1562.