Disable / tamper logging
Event, audit or cloud logging turned off
categoryPhysical, insider and cross-cutting attacksseverityMediumdetectability (measured in our lab)Lowlabpartially detected
Detection opportunity what to watch for
A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.
What the attacker runs
sudo /opt/lab/detonate.sh --technique T1690 --tool atomic --run-id <run-id> -- pwsh -c 'Import-Module invoke-atomicredteam; Invoke-AtomicTest T1690 -TestGuids b3dacb6c-a9e3-44ec-bf87-38db60c5cad1 -PathToAtomicsFolder /opt/AtomicRedTeam/atomics -TimeoutSeconds 120'sudo /opt/lab/detonate.sh --technique T1690 --tool atomic --run-id run-2026-10-27-032 -- pwsh -c 'Import-Module invoke-atomicredteam; Invoke-AtomicTest T1690 -TestGuids b3dacb6c-a9e3-44ec-bf87-38db60c5cad1 -PathToAtomicsFolder /opt/AtomicRedTeam/atomics -TimeoutSeconds 120'What our lab measured
partially detected linux · 2026-10-27
Plus 3 stock Wazuh/Sysmon rule(s) in the window.
Background noise in the window: ~196 incidental alerts/hour — tune against this.
Classification
36 values: 10 reviewed, 2 lab-measured, 19 imported, 5 derived. What do these mean?
Exploitability
| Attack vector | Post-compromise / campaign |
|---|---|
| Reach (CVSS) | Local |
| Attack complexity | Low |
| Privileges required | High |
| User interaction | None |
| Attacker skill required | Low |
| Resources required | Low |
| Likelihood / prevalence | Medium |
| Maturity | Commoditized |
Impact & scope
| Severity | Medium |
|---|---|
| Impact | Availability |
| Platform | IaaSIdentity ProviderLinuxOffice SuiteSaaSWindows |
| Environment | CloudOn-premises |
| Target asset class | EndpointServer |
| Kill-chain phase (tactic) | Defense Impairment |
Detection & telemetry
| Detectability (measured in our lab) | Low |
|---|---|
| Detectability (public detection content) | High |
| Noise level | High |
| Testability | Atomic Red Team test |
| Data sources (ATT&CK data components) | Application Log ContentCloud Service DisableCloud Service ModificationCommand ExecutionFile ModificationProcess CreationProcess ModificationUser Account ModificationWindows Registry Key Modification |
| Defense bypassed | Log analysis |
Detection & response
Mitigated by 8
- M1018 attack-mitigation
- M1022 attack-mitigation
- M1024 attack-mitigation
- M1047 attack-mitigation
D3-ACHd3fendD3-CId3fendD3-DRAd3fendD3-RCd3fend
Detected by 3
Tested by 1
b3dacb6c-a9e3-44ec-bf87-38db60c5cad1atomic
Lab findings
Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.
| Run | Outcome | Tool | Platform | Ran at |
|---|---|---|---|---|
run-2026-10-27-032 | partially-detected | atomic | linux | 2026-10-27 |
run-2026-10-27-032— Curated hand-written benign probe (G1 backlog-growth authoring; not auto-generated). No corpus attack record carries T1690 exactly, so attack_slug is declared (ingest emits against it with a 'does not carry' warning). Lab-safety: Exports HISTFILE=/dev/null inside the test's own bash process and runs whoami/groups; shell-process-local, no file touched, non-root, cleanup restores the variable.; expected=0 incidental=5 max_level=3 dwell_s=90
Framework references
- Primary source: https://www.picussecurity.com/resource/blog/t1562-impair-defenses
- attack: T1562.002 (primary)
- attack: T1562.008
- attack: T1562.012
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Physical, insider and cross-cutting attacks' table, line 691 of Cyber-Attack-Taxonomy.md
- ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK T1562.002 was revoked and replaced by T1685.001 in v19.2; facets imported from the replacement technique.
- ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK T1562.008 was revoked and replaced by T1685.002 in v19.2; facets imported from the replacement technique.
- ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK T1562.012 was revoked and replaced by T1685.004 in v19.2; facets imported from the replacement technique.
- ev-0005 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 1 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
- ev-0006 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 2 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
- ev-0007 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 6 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
- ev-0008 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-032 (partially-detected) for T1690: no alert matched the expected technique