CAPEC Definitions

    CAPEC Definitions / CAPEC-578

    CAPEC-578: Disable Security Software

    An adversary exploits a weakness in access control to disable security tools so that detection does not occur. This can take the form of killing processes, deleting registry keys so that tools do not start at run time, deleting log files, or other methods.

    Severity:Medium
    Possibility:Medium

    Extended Description

    No Extended Description.

    Mitigations

    Ensure proper permissions are in place to prevent adversaries from altering the execution status of security tools.

    Relationships with other CAPECs

    CAPEC-176: Configuration/Environment Manipulation

    Details

    Prerequisites

    The adversary must have the capability to interact with the configuration of the targeted system.

    Related Weaknesses

    CWE-284: Improper Access Control

    Details