tfMITRE ATT&CK sub-technique

Impair Autonomous Defenses T1685.007

sub-technique of T1685 Disable or Modify Tools

Tactic: Defense Impairment
Platforms: Windows, SaaS
Version: 1.0
Created: 22 September 2026
Last modified: 09 October 2026
Contributor: Vijay Lalwani

Adversaries may use methods like Indirect Prompt Injection to disrupt, disable, or otherwise impair autonomous defensive capabilities such as LLM-assisted processing of malware, artifacts, or activity.[1] This behavior may cause a system to ignore data, fail to alert on malicious activity, abort analysis, or to be disabled completely.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 27% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 53% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 30% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Offense vs defense T1685.007

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Offense vs defense T1685.007

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Select	Title	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
No rules found. Try adjusting your filters.

Title

Description

Impair Autonomous Defenses T1685.007

Impair Autonomous Defenses T1685.007

Offense vs defense T1685.007

Impair Autonomous Defenses mitigations T1685.007

Offense vs defense T1685.007

Impair Autonomous Defenses mitigations T1685.007

Impair Autonomous Defenses detections T1685.007

Impair Autonomous Defenses detections T1685.007