| 名称 |
Disable Security Software |
|
| 攻击可能性 |
典型严重性 |
| Medium |
Medium |
|
| 摘要 |
An adversary exploits a weakness in access control to disable security tools so that detection does not occur. This can take the form of killing processes, deleting registry keys so that tools do not start at run time, deleting log files, or other methods. |
| 前置条件 |
The adversary must have the capability to interact with the configuration of the targeted system. |
| 解决方案 | Ensure proper permissions are in place to prevent adversaries from altering the execution status of security tools. |
| 关联弱点 |
|
CWE 编号
|
描述
|
| CWE-284 |
Improper Access Control |
|
| 关联 CAPEC |
|
CAPEC 编号
|
描述
|
| CAPEC-176 |
An attacker manipulates files or settings external to a target application which affect the behavior of that application. For example, many applications use external configuration files and libraries - modification of these entities or otherwise affecting the application's ability to use them would constitute a configuration/environment manipulation attack. |
|
| 分类体系：ATTACK |
|
条目编号
|
条目名称
|
| 1556.006 |
Modify Authentication Process: Multi-Factor Authentication |
| 1562.001 |
Impair Defenses: Disable or Modify Tools |
| 1562.002 |
Impair Defenses: Disable Windows Event Logging |
| 1562.004 |
Impair Defenses: Disable or Modify System Firewall |
| 1562.007 |
Impair Defenses: Disable or Modify Cloud Firewall |
| 1562.008 |
Impair Defenses: Disable Cloud Logs |
| 1562.009 |
Impair Defenses: Safe Mode Boot |
|