Impair Defenses: Impair Command History Logging

Defense Evasion [Mitre]

Adversaries may impair command history logging to hide commands they run on a compromised system. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.

--windows-- The PSReadLine module tracks commands used in all PowerShell sessions and writes them to a file ($env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt by default).

Adversaries may …

Impair Defenses: Indicator Blocking

Defense Evasion [Mitre]

An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed. This could include maliciously redirecting or even disabling host-based sensors, such as Event Tracing for Windows (ETW), by tampering settings that control the collection and flow of event telemetry. These settings may be stored on the system in configuration files and/or in …

Impair Defenses: Safe Mode Boot

Defense Evasion [Mitre]

Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode. There are two versions of safe mode: Safe Mode and Safe Mode with Networking. …

Impair Defenses: Downgrade Attack

Defense Evasion [Mitre]

Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls such as logging. For example, PowerShell versions 5+ includes Script Block Logging (SBL) which can record executed script content. However, adversaries may attempt to execute a previous version of PowerShell that does not support SBL with the intent …

Indicator Removal: Clear Command History

Defense Evasion [Mitre]

In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.

On Windows hosts, PowerShell has two different command history providers: the built-in history …

Modify Registry

Defense Evasion [Mitre]

Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.

Access to specific areas of the Registry depends on account permissions, some requiring administrator-level access. The built-in Windows command-line utility Reg may be used for local …

Obfuscated Files or Information: Dynamic API Resolution

Defense Evasion [Mitre]

Adversaries may obfuscate then dynamically resolve API functions called by their malware in order to conceal malicious functionalities and impair defensive analysis. Malware commonly uses various Native API functions provided by the OS to perform various tasks such as those involving processes, files, and other system artifacts.

API functions called by malware may leave static artifacts such as strings …

Process Injection: Dynamic-link Library Injection

Defense Evasion [Mitre]

Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges. DLL injection is a method of executing arbitrary code in the address space of a separate live process.

DLL injection is commonly performed by writing the path to a DLL in the virtual address space of the target process …

Process Injection: Process Doppelgänging

Defense Evasion [Mitre]

Adversaries may inject malicious code into process via process doppelgänging in order to evade process-based defenses as well as possibly elevate privileges. Process doppelgänging is a method of executing arbitrary code in the address space of a separate live process.

Windows Transactional NTFS (TxF) was introduced in Vista as a method to perform safe file operations. To ensure data …

Process Injection: ListPlanting

Defense Evasion [Mitre]

Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. ListPlanting is a method of executing arbitrary code in the address space of a separate live process. Code executed via ListPlanting may also evade detection from security products since the execution is masked under a legitimate …

Search For Content

Search Result

Impair Defenses: Impair Command History Logging

Defense Evasion [Mitre]

Impair Defenses: Indicator Blocking

Defense Evasion [Mitre]

Impair Defenses: Safe Mode Boot

Defense Evasion [Mitre]

Impair Defenses: Downgrade Attack

Defense Evasion [Mitre]

Indicator Removal: Clear Command History

Defense Evasion [Mitre]

Modify Registry

Defense Evasion [Mitre]

Obfuscated Files or Information: Dynamic API Resolution

Defense Evasion [Mitre]

Process Injection: Dynamic-link Library Injection

Defense Evasion [Mitre]

Process Injection: Process Doppelgänging

Defense Evasion [Mitre]

Process Injection: ListPlanting

Defense Evasion [Mitre]