Defense Impairment Detection Rules
The adversary is trying to break security mechanisms, pipelines, and tooling so defenders can’t see or trust what’s happening. Defense Impairment consists of techniques that degrade, disable, or undermine the effectiveness and trustworthiness of security controls and monitoring mechanisms. These techniques are characterized by direct interference with defensive systems. The goal is to reduce defenders’ ability to detect, interpret, or respond to adversary activity.
df00tech ships 54 production-ready detection rules mapped to the Defense Impairment tactic (TA0112). Each rule below includes copy-paste queries for Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), QRadar, Sumo Logic, Chronicle and LogScale, with data-source requirements, severity and false-positive guidance — free to use.
Defense Impairment detections (54)
- T1112 Modify Registry
- T1207 Rogue Domain Controller
- T1222 File and Directory Permissions Modification
- T1222.001 Windows File and Directory Permissions Modification
- T1222.002 Linux and Mac File and Directory Permissions Modification
- T1484 Domain or Tenant Policy Modification
- T1484.001 Group Policy Modification
- T1484.002 Trust Modification
- T1553 Subvert Trust Controls
- T1553.001 Gatekeeper Bypass
- T1553.002 Code Signing
- T1553.003 SIP and Trust Provider Hijacking
- T1553.004 Install Root Certificate
- T1553.005 Mark-of-the-Web Bypass
- T1553.006 Code Signing Policy Modification
- T1556 Modify Authentication Process
- T1556.001 Domain Controller Authentication
- T1556.002 Password Filter DLL
- T1556.003 Pluggable Authentication Modules
- T1556.004 Network Device Authentication
- T1556.005 Reversible Encryption
- T1556.006 Multi-Factor Authentication
- T1556.007 Hybrid Identity
- T1556.008 Network Provider DLL
- T1556.009 Conditional Access Policies
- T1578 Modify Cloud Compute Infrastructure
- T1578.001 Create Snapshot
- T1578.002 Create Cloud Instance
- T1578.003 Delete Cloud Instance
- T1578.004 Revert Cloud Instance
- T1578.005 Modify Cloud Compute Configurations
- T1599 Network Boundary Bridging
- T1599.001 Network Address Translation Traversal
- T1600 Weaken Encryption
- T1600.001 Reduce Key Space
- T1600.002 Disable Crypto Hardware
- T1601 Modify System Image
- T1601.001 Patch System Image
- T1601.002 Downgrade System Image
- T1647 Plist File Modification
- T1666 Modify Cloud Resource Hierarchy
- T1685 Disable or Modify Tools
- T1685.001 Disable Windows Event Logging
- T1685.002 Disable or Modify Cloud Logs
- T1685.003 Spoof Security Alerting
- T1685.004 Disable or Modify Linux Audit System
- T1685.005 Clear Windows Event Logs
- T1685.006 Clear Linux or Mac System Logs
- T1686 Disable or Modify System Firewall
- T1686.001 Disable or Modify Cloud Firewall
- T1686.002 Disable or Modify Network Device Firewall
- T1688 Safe Mode Boot
- T1689 Downgrade Attack
- T1690 Impair Command History Logging
Related tactics
377 detections
324 detections