MITRE ATT&CK - Técnica

T1687: Exploitation for Defense Impairment

Exploitation for Defense Impairment (T1687) é uma técnica catalogada no MITRE ATT&CK Enterprise usada como referência para mapear comportamento adversário em auditorias de segurança.

Técnica T1687 Enterprise ATT&CK

Contexto para AppSec

Em uma auditoria de AppSec, Exploitation for Defense Impairment deve ser usada para revisar caminhos em que código, configuração, dependências ou infraestrutura podem viabilizar o comportamento descrito pela MITRE. No ATT&CK, ela aparece em Defense Impairment. As plataformas mapeadas pela MITRE incluem IaaS, Linux, macOS, SaaS e Windows. No Vigly, esse contexto ajuda a conectar evidências do repositório com priorização e remediação.

Tática/fase Defense Impairment
Plataformas MITRE IaaS, Linux, macOS, SaaS, Windows

Descrição oficial original do MITRE ATT&CK

Adversaries may exploit vulnerabilities in security software, infrastructure, or defensive components to degrade, disable, or otherwise continue to impair their ability to prevent, detect, or respond to malicious activity. Adversaries may exploit a system or application vulnerability to directly interfere with defensive mechanisms. Exploitation occurs when an adversary takes advantage of a programming error in software, services, or the operating system to execute adversary-controlled code, often with the goal of weakening or disabling protections. Vulnerabilities may exist in security tools such as antivirus, endpoint detection and response (EDR), firewalls, or other monitoring solutions. Adversaries may use prior reconnaissance or perform discovery activities (e.g., Software Discovery) to identify defensive tools present in an environment and target them for exploitation. Successful exploitation may allow adversaries to terminate security processes, disable protections, bypass enforcement mechanisms, or reduce the effectiveness of defensive controls. In some cases, vulnerabilities in cloud-based or SaaS infrastructure may also be leveraged to bypass built-in security boundaries or disrupt visibility and enforcement across environments.

Ver fonte oficial no MITRE ATT&CK

Como o Vigly audita a técnica Exploitation for Defense Impairment automaticamente na sua pipeline

O Vigly cruza sinais de SAST, modelagem de ameaças, regras de negócio e evidências do repositório para priorizar riscos reais antes que eles cheguem à produção.

Conhecer a plataforma