Impair Defenses: Impair Command History Logging

Defense Evasion [Mitre]

Adversaries may impair command history logging to hide commands they run on a compromised system. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.

--windows-- The PSReadLine module tracks commands used in all PowerShell sessions and writes them to a file ($env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt by default).

Adversaries may …

Impair Defenses: Disable or Modify System Firewall

Defense Evasion [Mitre]

Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules. This can be done numerous ways depending on the operating system, including via command-line, editing Windows Registry keys, and Windows Control Panel.

Modifying or disabling a system firewall …

Impair Defenses: Indicator Blocking

Defense Evasion [Mitre]

An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed. This could include maliciously redirecting or even disabling host-based sensors, such as Event Tracing for Windows (ETW), by tampering settings that control the collection and flow of event telemetry. These settings may be stored on the system in configuration files and/or in …

Impair Defenses: Downgrade Attack

Defense Evasion [Mitre]

Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls such as logging. For example, PowerShell versions 5+ includes Script Block Logging (SBL) which can record executed script content. However, adversaries may attempt to execute a previous version of PowerShell that does not support SBL with the intent …

Indicator Removal: Clear Mailbox Data

Defense Evasion [Mitre]

Adversaries may modify mail application data to remove evidence of their activity. Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs. Mail application data can be emails or logs generated by the application or operating system, such as export requests.

Adversaries may manipulate email mailbox data to …

Indirect Command Execution

Defense Evasion [Mitre]

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking cmd.

Adversaries may abuse these features for Defense Evasion, specifically to perform arbitrary execution while subverting detections and/or mitigation controls (such as Group Policy) that limit/prevent the …

Masquerading: Rename System Utilities

Defense Evasion [Mitre]

Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for system utilities adversaries are capable of abusing. It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename rundll32.exe). An alternative case occurs when a …

Modify Authentication Process: Password Filter DLL

Defense Evasion [Mitre]

Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentication process to acquire user credentials as they are validated.

Windows password filters are password policy enforcement mechanisms for both domain and local accounts. Filters are implemented as DLLs containing a method to validate potential passwords against password policies. Filter DLLs can be positioned on local computers …

Modify Authentication Process: Multi-Factor Authentication

Defense Evasion [Mitre]

Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.

Once adversaries have gained access to a network by either compromising an account lacking MFA or by employing an MFA bypass method such as Multi-Factor Authentication Request Generation, adversaries may leverage their access to modify or completely disable MFA defenses. This can be …

Obfuscated Files or Information: HTML Smuggling

Defense Evasion [Mitre]

Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files. HTML documents can store large binary objects known as JavaScript Blobs (immutable data that represents raw bytes) that can later be constructed into file-like objects. Data may also be stored in Data URLs, which enable embedding media type or MIME files …

Search For Content

Search Result

Impair Defenses: Impair Command History Logging

Defense Evasion [Mitre]

Impair Defenses: Disable or Modify System Firewall

Defense Evasion [Mitre]

Impair Defenses: Indicator Blocking

Defense Evasion [Mitre]

Impair Defenses: Downgrade Attack

Defense Evasion [Mitre]

Indicator Removal: Clear Mailbox Data

Defense Evasion [Mitre]

Indirect Command Execution

Defense Evasion [Mitre]

Masquerading: Rename System Utilities

Defense Evasion [Mitre]

Modify Authentication Process: Password Filter DLL

Defense Evasion [Mitre]

Modify Authentication Process: Multi-Factor Authentication

Defense Evasion [Mitre]

Obfuscated Files or Information: HTML Smuggling

Defense Evasion [Mitre]