AWS ArchiveFindings
Archives specified GuardDuty findings in a regional detector.
Defense Impairment
Defense Impairment
Section titled “Defense Impairment”The adversary is trying to break security mechanisms, pipelines, and tooling so defenders can’t see or trust what’s happening.
Defense Impairment consists of techniques that degrade, disable, or undermine the effectiveness and trustworthiness of security controls and monitoring mechanisms. These techniques are characterized by direct interference with defensive systems. The goal is to reduce defenders’ ability to detect, interpret, or respond to adversary activity.
In cloud environments, adversaries impair defenses by disabling or deleting logging services (CloudTrail, Azure diagnostic settings, GCP logging sinks), modifying or removing security group and firewall rules, tampering with audit logs, or stopping monitoring services like GuardDuty and Microsoft Defender for Cloud.
Defense Impairment (TA0112) was introduced in ATT&CK v19 (April 2026), when the former Defense Evasion tactic was split into Stealth and Defense Impairment.
View Defense Impairment on MITRE ATT&CK →Events Related to Defense Impairment
Section titled “Events Related to Defense Impairment”Explore this tactic in the map.
AWS AuthorizeDBSecurityGroupIngress
Authorizes ingress to an RDS DB security group through a legacy networking API.
AWS AuthorizeSecurityGroupEgress
Adds outbound allow rules to an EC2 security group.
AWS AuthorizeSecurityGroupIngress
Adds inbound allow rules to an EC2 security group.
GCP compute.firewalls.delete
Deletes a VPC firewall rule.
GCP compute.firewalls.patch
Patches an existing VPC firewall rule.
AWS CreateFilter
Creates a GuardDuty finding filter, optionally with an automatic archive action.
AWS CreateIPSet
Creates a GuardDuty trusted IP list and optionally requests activation.
AWS CreateNetworkAclEntry
Adds an inbound or outbound allow/deny rule to a VPC network ACL.
AWS CreateOpenIDConnectProvider
Registers an OIDC identity provider in IAM.
AWS CreateSAMLProvider
Registers SAML identity-provider metadata in IAM.
AWS DeactivateMFADevice
Deactivates a specified MFA device and removes its association with a user.
AWS DeleteAlarms
Deletes specified CloudWatch alarms in an account and Region.
AWS DeleteBucket
Deletes an empty S3 bucket, after all object versions and delete markers are removed.
AWS DeleteConfigRule
Deletes an AWS Config rule and its evaluation results.
AWS DeleteConfigurationRecorder
Deletes a customer-managed AWS Config recorder in one Region.
AWS DeleteDeliveryChannel
Deletes an AWS Config delivery channel after customer-managed recording is stopped.
AWS DeleteDetector
Deletes a regional GuardDuty detector, disabling GuardDuty for that account and Region.
AWS DeleteEventDataStore
Disables a CloudTrail Lake event data store and starts a seven-day deletion window.
AWS DeleteFlowLogs
Deletes selected VPC Flow Log configurations without deleting their previously delivered log data.
AWS DeleteLogGroup
Deletes a CloudWatch Logs group and permanently removes its stored log events.
AWS DeleteLogStream
Deletes a CloudWatch Logs stream and permanently removes its stored events.
AWS DeleteMembers
Deletes GuardDuty member records from an administrator’s regional detector.
AWS DeleteNetworkAcl
Deletes a nondefault VPC network ACL that has no subnet associations.
AWS DeleteNetworkAclEntry
Deletes a numbered inbound or outbound rule from a VPC network ACL.
AWS DeleteObjects
Requests deletion of multiple S3 object keys or specific versions in one batch.
AWS DeleteRuleGroup
Deletes an AWS WAFv2 rule group identified by name, ID, and scope.
AWS DeleteTrail
Deletes a CloudTrail trail and stops its future collection without deleting previously delivered logs.
AWS DeleteVirtualMFADevice
Deletes an unassigned virtual MFA device resource.
AWS DeleteWebACL
Deletes an unassociated AWS WAFv2 web ACL not managed by Firewall Manager.
AWS DisassociateFromMasterAccount
Legacy API for disassociating a GuardDuty member from its administrator.
AWS DisassociateMembers
Disassociates specified members from a regional GuardDuty administrator.
GCP google.cloud.securitycenter.v1.SecurityCenter.SetMute
Changes the mute state of a Security Command Center finding.
GCP google.logging.v2.ConfigServiceV2.UpdateExclusion
Updates an exclusion in a resource’s _Default logging sink.
GCP google.logging.v2.LoggingServiceV2.DeleteLog
Deletes a named log’s entries from the global _Default log bucket.
AWS LeaveOrganization
Removes the calling member account from its AWS organization.
GCP logging.projects.exclusions.create
Creates an exclusion in a resource’s _Default logging sink.
GCP logging.sinks.delete
Deletes a Cloud Logging sink.
GCP logging.sinks.update
Updates a Cloud Logging sink’s configuration.
Azure Microsoft.Compute/virtualMachines/delete
Requests deletion of an Azure virtual machine.
Azure Microsoft.EventHub/namespaces/eventhubs/delete
Deletes an Event Hub entity within an Azure Event Hubs namespace.
Azure Microsoft.HybridCompute/machines/extensions/delete
Requests removal of an extension from an Azure Arc-enabled server.
Azure Microsoft.Insights/activityLogAlerts/delete
Deletes an Azure Monitor activity log alert rule.
Azure Microsoft.Insights/diagnosticSettings/delete
Deletes an Azure Monitor diagnostic setting and its configured export routes.
Azure Microsoft.Insights/metricAlerts/delete
Deletes an Azure Monitor metric alert rule.
Azure Microsoft.Network/networkSecurityGroups/delete
Deletes an Azure network security group after its resource associations are removed.
Azure Microsoft.Network/networkSecurityGroups/securityRules/write
Creates or updates a rule in an Azure network security group.
Azure Microsoft.Network/networkWatchers/flowLogs/delete
Deletes an Azure Network Watcher flow-log configuration.
Azure Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write
Creates or updates one side of an Azure virtual network peering.
Azure Microsoft.OperationalInsights/workspaces/delete
Deletes an Azure Log Analytics workspace, with optional permanent deletion.
Azure Microsoft.Security/alertsSuppressionRules/write
Creates or updates a Defender for Cloud alert suppression rule.
Azure Microsoft.Security/autoProvisioningSettings/write
Updates the legacy Defender for Cloud agent auto-provisioning setting.
Azure Microsoft.Security/pricings/write
Changes a Microsoft Defender for Cloud plan configuration at a supported scope.
Azure Microsoft.Security/securitySolutions/delete
Deletes a Microsoft.Security security solution resource.
AWS ModifyDBInstance
Modifies RDS DB instance settings, subject to parameter-specific application rules.
AWS ModifyInstanceAttribute
Changes a supported EC2 instance attribute, including user data or security groups.
AWS PutBucketLifecycleConfiguration
Creates or replaces an S3 bucket lifecycle configuration.
AWS PutEventSelectors
Configures basic or advanced selectors that determine which events a CloudTrail trail records.
AWS RemoveAccountFromOrganization
Removes a specified member account from an AWS organization.
AWS ScheduleKeyDeletion
Schedules KMS key deletion and makes the pending key unavailable for cryptographic operations.
GCP SecurityCenter.UpdateOrganizationSettings (deprecated)
Updates legacy Security Command Center organization settings through a deprecated API.
AWS StopConfigurationRecorder
Stops the named customer-managed AWS Config recorder from recording its configured resource types.
AWS StopLogging
Stops logging API activity for a CloudTrail trail, disabling audit log collection for that trail.
AWS StopMonitoringMembers
Suspends GuardDuty monitoring for specified member accounts in a Region.
Azure Storage Analytics logging disabled
Disables selected legacy Azure Storage Analytics logging categories.
Azure Update Conditional Access Policy
Updates an existing Microsoft Entra Conditional Access policy.
Azure Update named location
Updates an Entra Conditional Access named network/location definition.
Azure Update User Authentication Methods
Records changes to a user’s registered Entra authentication methods.
AWS UpdateAssumeRolePolicy
Replaces an IAM role trust policy, changing the conditions for assuming it.
AWS UpdateDetector
Updates a regional GuardDuty detector, including its enabled state and protection features.
AWS UpdateIPSet
Updates a GuardDuty trusted IP list configuration and activation request.
AWS UpdateTrail
Changes a CloudTrail trail configuration, including delivery destinations, regional scope, and log-file validation.
Azure VaultPatch
Updates Azure Key Vault properties through a management-plane write.