Indicator Blocking (T1054)

View on ATT&CK

In Playbook

Technique & Subtechniques

  • Indicator Blocking

Associated Tactics

  • Defense Evasion

Defense Evasion (TA0005)

The adversary is trying to avoid being detected. Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics’ techniques are cross-listed here when those techniques include the added benefit of subverting defenses.

View on ATT&CK

Procedure Examples

Description Source(s)
capec
Microsoft. (2009, May 17). Backdoor:Win32/Lamin.A. Retrieved September 6, 2018. Microsoft Lamin Sept 2017
Microsoft. (2018, May 30). About Event Tracing. Retrieved June 7, 2019. Microsoft About Event Tracing 2018
Palantir. (2018, December 24). Tampering with Windows Event Tracing: Background, Offense, and Defense. Retrieved June 7, 2019. Medium Event Tracing Tampering 2018