tfMITRE ATT&CK technique

Exploitation for Defense Impairment T1687

Tactic: Defense Impairment
Platforms: IaaS, Linux, macOS, SaaS, Windows
Version: 1.0
Created: 14 April 2026
Last modified: 12 May 2026

Adversaries may exploit vulnerabilities in security software, infrastructure, or defensive components to degrade, disable, or otherwise continue to impair their ability to prevent, detect, or respond to malicious activity. Adversaries may exploit a system or application vulnerability to directly interfere with defensive mechanisms. Exploitation occurs when an adversary takes advantage of a programming error in software, services, or the operating system to execute adversary-controlled code, often with the goal of weakening or disabling protections.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Offense vs defense T1687

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Exploitation for Defense Impairment detection strategy DET0900

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Defense Impairment

Enterprise

5 platforms

AN2038 · Windows

Detects suspicious interactions with security products followed by service crashes, unexpected restarts, driver unloads, telemetry gaps, or tamper-state changes. Correlates exploit precursor behavior with immediate degradation of defensive services and follow-on process execution.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Service MetadataDC0041	WinEventLog:System	EventCode=7035
Driver LoadDC0079	WinEventLog:Sysmon	EventCode=6

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CrashCorrelationWindow	Time between suspicious interaction and security service failure
ProtectedServiceList	Security agents/services expected to remain stable
TelemetryGapThreshold	Acceptable heartbeat silence duration

AN2039 · Linux

Detects exploitation attempts against security daemons or kernel security modules followed by daemon termination, disabled logging, module unload, audit stoppage, or reduced endpoint telemetry. Correlates local execution or network input with control degradation.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Service MetadataDC0041	auditd:DAEMON	auditd stopped, config changed, logging suspended
Command ExecutionDC0064	auditd:EXECVE	execve, kill, ptrace, insmod, rmmod targeting security processes

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ProtectedProcessNames	Names of EDR, audit, AV, firewall daemons
ModuleUnloadAllowlist	Approved maintenance unload operations
HealthGapThreshold	Expected telemetry heartbeat tolerance

AN2040 · macOS

Detects crafted activity resulting in crashes or impairment of endpoint security extensions, network filters, launch daemons, or telemetry agents. Correlates process activity, system extension state changes, and telemetry interruption.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process MetadataDC0034	macos:unifiedlog	Crash or abnormal termination of security agent or system extension host
Driver MetadataDC0074	macos:unifiedlog	Extension disabled, unloaded, failed to start
Network Traffic ContentDC0085	NSM:Flow	Traffic spike preceding control crash

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ExtensionList	Protected security system extensions
CrashBurstThreshold	Multiple failures in short interval

AN2041 · IaaS

Detects exploitation of cloud-native security boundaries or management components followed by disabled logging, detached agents, changed security groups, policy bypass, or telemetry suppression. Correlates suspicious API activity with reduced control coverage.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Firewall Rule ModificationDC0051	AWS:CloudTrail	AuthorizeSecurityGroupIngress
Instance ModificationDC0073	AWS:CloudTrail	ModifyInstanceAttribute
Cloud Service DisableDC0090	AWS:CloudTrail	StopLogging, DeleteTrail, or DisableSecurityService

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CriticalTrailList	Audit trails that must remain enabled
ControlChangeWindow	Time after suspicious API sequence to inspect coverage loss

AN2042 · SaaS

Detects exploitation or abuse of SaaS security workflows resulting in disabled alerts, reduced retention, bypassed enforcement, role escalation, or tokenized persistence that weakens monitoring. Correlates unusual admin/API activity with visibility reduction.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Application Log ContentDC0038	m365:unified	Set-AdminAuditLogConfig;New-ApplicationAccessPolicy;ConsentToApplication

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
PrivilegedActorAllowlist	Approved admins allowed to change controls
RetentionChangeThreshold	Minimum acceptable logging retention

Exploitation for Defense Impairment detections T1687

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs