Alert Pack: Impair Defenses (MITRE Att&ck Technique: T1562)
- Juan Tomás Alonso Nieto (Deactivated)
Purpose
This alert pack helps your SOC teams signature-based detections by combining our various detections that protect against an adversary that has infiltrated your system and it is trying to remove barriers for other adversaries.
This alert will help your SOC know what the attacker is attempting as they attempt it and provide the necessary information so that the SOC can stop and remediate and remediate any damage caused before it is too late.
Â
What is to Impair Defenses?
Adversaries may maliciously modify components of a victim’s environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as firewalls and anti-virus but also detection capabilities that can use to audit activity and identify malicious behavior. This may also span both native defenses as well as supplemental capabilities installed by users and administrators.
Prerequisites
To use this alert pack, you must have the following data sources available on your domain:
cloud.azure.activity.eventslearn morecloud.office365.managementlearn morecloud.azure.vm.unknown_eventslearn morecloud.office365.management.exchangelearn morebox.unixlearn morecloud.aws.cloudtraillearn morecloud.gcplearn morebox.all.winlearn morecloud.azure.eh.eventslearn more
Open alert pack
Once you have installed the alert pack, you can use the Open button at the top right of the card in Exchange to access the Alert configuration, where you can apply filters to find it and later manage it as required. You can also access this area via the Navigation pane (Administration → Alert Configuration → Available alerts).
Use alert pack
The alerts in the alert pack are deactivated by default when the alert pack is installed. Access the Alert configuration area to activate those you need and assign sending policies to receive them through the desired channels.