COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-578

Disable Security Software

An adversary exploits a weakness in access control to disable security tools so that detection does not occur. This can take the form of killing processes, deleting registry keys so that tools do not start at run time, deleting log files, or other methods.

Abstraction

Standard

Typical severity

Medium

Likelihood of attack

Medium

Understand the attack

What is this attack pattern?

An adversary exploits a weakness in access control to disable security tools so that detection does not occur. This can take the form of killing processes, deleting registry keys so that tools do not start at run time, deleting log files, or other methods.

Requirements

What does the attack require?

Prerequisites

  • The adversary must have the capability to interact with the configuration of the targeted system.

Skills required

Not stated in the MITRE record.

Resources required

  • None: No specialized resources are required to execute this type of attack.

Impact

What does a successful attack lead to?

Hide Activities

Affected scopes: Availability

Defence

How is it prevented and mitigated?

1
Ensure proper permissions are in place to prevent adversaries from altering the execution status of security tools.