{"description": "Enterprise techniques used by Disable or Remove Feature or Program, ATT&CK mitigation M1042 v1.1", "name": "Disable or Remove Feature or Program (M1042)", "domain": "enterprise-attack", "versions": {"layer": "4.3", "attack": "10", "navigator": "4.5"}, "techniques": [{"techniqueID": "T1098", "showSubtechniques": true}, {"score": 1, "techniqueID": "T1098.004", "showSubtechniques": true, "comment": "Disable SSH if it is not necessary on a host or restrict SSH access for specific users/groups using /etc/ssh/sshd_config."}, {"score": 1, "techniqueID": "T1557", "showSubtechniques": true, "comment": "Disable legacy network protocols that may be used   to intercept network traffic if applicable, especially those that are not needed within an environment."}, {"score": 1, "techniqueID": "T1557.001", "showSubtechniques": true, "comment": "Disable LLMNR and NetBIOS in local computer security settings or by group policy if they are not needed within an environment. (Citation: ADSecurity Windows Secure Baseline)"}, {"score": 1, "techniqueID": "T1557.002", "showSubtechniques": true, "comment": "Consider disabling updating the ARP cache on gratuitous ARP replies."}, {"techniqueID": "T1547", "showSubtechniques": true}, {"score": 1, "techniqueID": "T1547.007", "showSubtechniques": true, "comment": "This feature can be disabled entirely with the following terminal command: defaults write -g ApplePersistence -bool no."}, {"score": 1, "techniqueID": "T1059", "showSubtechniques": true, "comment": "Disable or remove any unnecessary or unused shells or interpreters."}, {"score": 1, "techniqueID": "T1059.001", "showSubtechniques": true, "comment": "It may be possible to remove PowerShell from systems when not needed, but a review should be performed to assess the impact to an environment, since it could be in use for many legitimate purposes and administrative functions.\n\nDisable/restrict the WinRM Service to help prevent uses of PowerShell for remote execution."}, {"score": 1, "techniqueID": "T1059.005", "showSubtechniques": true, "comment": "Turn off or restrict access to unneeded VB components."}, {"score": 1, "techniqueID": "T1059.007", "showSubtechniques": true, "comment": "Turn off or restrict access to unneeded scripting components."}, {"score": 1, "techniqueID": "T1092", "showSubtechniques": false, "comment": "Disable Autoruns if it is unnecessary.(Citation: Microsoft Disable Autorun)"}, {"techniqueID": "T1555", "showSubtechniques": true}, {"score": 1, "techniqueID": "T1555.004", "showSubtechniques": true, "comment": "Consider enabling the \u201cNetwork access: Do not allow storage of passwords and credentials for network authentication\u201d setting that will prevent network credentials from being stored by the Credential Manager.(Citation: Microsoft Network access Credential Manager)"}, {"techniqueID": "T1114", "showSubtechniques": true}, {"score": 1, "techniqueID": "T1114.003", "showSubtechniques": true, "comment": "Consider disabling external email forwarding.(Citation: Microsoft BEC Campaign)"}, {"techniqueID": "T1546", "showSubtechniques": true}, {"score": 1, "techniqueID": "T1546.002", "showSubtechniques": true, "comment": "Use Group Policy to disable screensavers if they are unnecessary.(Citation: TechNet Screensaver GP)"}, {"score": 1, "techniqueID": "T1546.014", "showSubtechniques": true, "comment": "Consider disabling emond by removing the [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) plist file."}, {"techniqueID": "T1011", "showSubtechniques": true}, {"score": 1, "techniqueID": "T1011.001", "showSubtechniques": true, "comment": "Disable Bluetooth in local computer security settings or by group policy if it is not needed within an environment."}, {"score": 1, "techniqueID": "T1052", "showSubtechniques": true, "comment": "Disable Autorun if it is unnecessary. (Citation: Microsoft Disable Autorun) Disallow or restrict removable media at an organizational policy level if they are not required for business operations. (Citation: TechNet Removable Media Control)"}, {"score": 1, "techniqueID": "T1052.001", "showSubtechniques": true, "comment": "Disable Autorun if it is unnecessary. (Citation: Microsoft Disable Autorun) Disallow or restrict removable media at an organizational policy level if they are not required for business operations. (Citation: TechNet Removable Media Control)"}, {"score": 1, "techniqueID": "T1210", "showSubtechniques": false, "comment": "Minimize available services to only those that are necessary."}, {"score": 1, "techniqueID": "T1133", "showSubtechniques": false, "comment": "Disable or block remotely available services that may be unnecessary."}, {"techniqueID": "T1564", "showSubtechniques": true}, {"score": 1, "techniqueID": "T1564.006", "showSubtechniques": true, "comment": "Disable Hyper-V if not necessary within a given environment."}, {"score": 1, "techniqueID": "T1564.007", "showSubtechniques": true, "comment": "Turn off or restrict access to unneeded VB components.(Citation: Microsoft Disable VBA Jan 2020)"}, {"techniqueID": "T1562", "showSubtechniques": true}, {"score": 1, "techniqueID": "T1562.010", "showSubtechniques": true, "comment": "Consider removing previous versions of tools that are unnecessary to the environment when possible."}, {"score": 1, "techniqueID": "T1559", "showSubtechniques": true, "comment": "Registry keys specific to Microsoft Office feature control security can be set to disable automatic DDE/OLE execution. (Citation: Microsoft DDE Advisory Nov 2017)(Citation: BleepingComputer DDE Disabled in Word Dec 2017)(Citation: GitHub Disable DDEAUTO Oct 2017) Microsoft also created, and enabled by default, Registry keys to completely disable DDE execution in Word and Excel.(Citation: Microsoft ADV170021 Dec 2017)"}, {"score": 1, "techniqueID": "T1559.002", "showSubtechniques": true, "comment": "Registry keys specific to Microsoft Office feature control security can be set to disable automatic DDE/OLE execution. (Citation: Microsoft DDE Advisory Nov 2017)(Citation: BleepingComputer DDE Disabled in Word Dec 2017)(Citation: GitHub Disable DDEAUTO Oct 2017) Microsoft also created, and enabled by default, Registry keys to completely disable DDE execution in Word and Excel.(Citation: Microsoft ADV170021 Dec 2017)"}, {"score": 1, "techniqueID": "T1046", "showSubtechniques": false, "comment": "Ensure that unnecessary ports and services are closed to prevent risk of discovery and potential exploitation."}, {"score": 1, "techniqueID": "T1137", "showSubtechniques": true, "comment": "Follow Office macro security best practices suitable for your environment. Disable Office VBA macros from executing.\n\nDisable Office add-ins. If they are required, follow best practices for securing them by requiring them to be signed and disabling user notification for allowing add-ins. For some add-ins types (WLL, VBA) additional mitigation is likely required as disabling add-ins in the Office Trust Center does not disable WLL nor does it prevent VBA code from executing. (Citation: MRWLabs Office Persistence Add-ins)"}, {"score": 1, "techniqueID": "T1137.001", "showSubtechniques": true, "comment": "Follow Office macro security best practices suitable for your environment. Disable Office VBA macros from executing.\n\nDisable Office add-ins. If they are required, follow best practices for securing them by requiring them to be signed and disabling user notification for allowing add-ins. For some add-ins types (WLL, VBA) additional mitigation is likely required as disabling add-ins in the Office Trust Center does not disable WLL nor does it prevent VBA code from executing. (Citation: MRWLabs Office Persistence Add-ins)\n"}, {"score": 1, "techniqueID": "T1563", "showSubtechniques": true, "comment": "Disable the remote service (ex: SSH, RDP, etc.) if it is unnecessary."}, {"score": 1, "techniqueID": "T1563.001", "showSubtechniques": true, "comment": "Ensure that agent forwarding is disabled on systems that do not explicitly require this feature to prevent misuse. (Citation: Symantec SSH and ssh-agent)"}, {"score": 1, "techniqueID": "T1563.002", "showSubtechniques": true, "comment": "Disable the RDP service if it is unnecessary."}, {"techniqueID": "T1021", "showSubtechniques": true}, {"score": 1, "techniqueID": "T1021.001", "showSubtechniques": true, "comment": "Disable the RDP service if it is unnecessary."}, {"score": 1, "techniqueID": "T1021.003", "showSubtechniques": true, "comment": "Consider disabling DCOM through Dcomcnfg.exe.(Citation: Microsoft Disable DCOM)"}, {"score": 1, "techniqueID": "T1021.004", "showSubtechniques": true, "comment": "Disable the SSH daemon on systems that do not require it. For macOS ensure Remote Login is disabled under Sharing Preferences.(Citation: Apple Unified Log Analysis Remote Login and Screen Sharing)"}, {"score": 1, "techniqueID": "T1021.005", "showSubtechniques": true, "comment": "Uninstall any VNC server software where not required."}, {"score": 1, "techniqueID": "T1021.006", "showSubtechniques": true, "comment": "Disable the WinRM service."}, {"score": 1, "techniqueID": "T1091", "showSubtechniques": false, "comment": "Disable Autorun if it is unnecessary. (Citation: Microsoft Disable Autorun) Disallow or restrict removable media at an organizational policy level if it is not required for business operations. (Citation: TechNet Removable Media Control)"}, {"score": 1, "techniqueID": "T1505", "showSubtechniques": true, "comment": "Consider disabling software components from servers when possible to prevent abuse by adversaries.(Citation: ITSyndicate Disabling PHP functions)"}, {"score": 1, "techniqueID": "T1505.003", "showSubtechniques": true, "comment": "Consider disabling functions from web technologies such as PHP\u2019s eval() that may be abused for web shells.(Citation: ITSyndicate Disabling PHP functions)"}, {"score": 1, "techniqueID": "T1218", "showSubtechniques": true, "comment": "Many native binaries may not be necessary within a given environment."}, {"score": 1, "techniqueID": "T1218.003", "showSubtechniques": true, "comment": "CMSTP.exe may not be necessary within a given environment (unless using it for VPN connection installation)."}, {"score": 1, "techniqueID": "T1218.004", "showSubtechniques": true, "comment": "InstallUtil may not be necessary within a given environment."}, {"score": 1, "techniqueID": "T1218.005", "showSubtechniques": true, "comment": "Mshta.exe may not be necessary within a given environment since its functionality is tied to older versions of Internet Explorer that have reached end of life."}, {"score": 1, "techniqueID": "T1218.007", "showSubtechniques": true, "comment": "Consider disabling the AlwaysInstallElevated policy to prevent elevated execution of Windows Installer packages.(Citation: Microsoft AlwaysInstallElevated 2018)"}, {"score": 1, "techniqueID": "T1218.008", "showSubtechniques": true, "comment": "Odbcconf.exe may not be necessary within a given environment."}, {"score": 1, "techniqueID": "T1218.009", "showSubtechniques": true, "comment": "Regsvcs and Regasm may not be necessary within a given environment."}, {"score": 1, "techniqueID": "T1218.012", "showSubtechniques": true, "comment": "Consider removing verclsid.exe if it is not necessary within a given environment."}, {"score": 1, "techniqueID": "T1218.013", "showSubtechniques": true, "comment": "Consider removing mavinject.exe if Microsoft App-V is not used within a given environment."}, {"score": 1, "techniqueID": "T1218.014", "showSubtechniques": true, "comment": "MMC may not be necessary within a given environment since it is primarily used by system administrators, not regular users or clients. "}, {"score": 1, "techniqueID": "T1221", "showSubtechniques": false, "comment": "Consider disabling Microsoft Office macros/active content to prevent the execution of malicious payloads in documents (Citation: Microsoft Disable Macros), though this setting may not mitigate the [Forced Authentication](https://attack.mitre.org/techniques/T1187) use for this technique."}, {"score": 1, "techniqueID": "T1205", "showSubtechniques": false, "comment": "Disable Wake-on-LAN if it is not needed within an environment."}, {"score": 1, "techniqueID": "T1127", "showSubtechniques": true, "comment": "Specific developer utilities may not be necessary within a given environment and should be removed if not used."}, {"score": 1, "techniqueID": "T1127.001", "showSubtechniques": true, "comment": "MSBuild.exe may not be necessary within an environment and should be removed if not being used."}, {"techniqueID": "T1552", "showSubtechniques": true}, {"score": 1, "techniqueID": "T1552.005", "showSubtechniques": true, "comment": "Disable unnecessary metadata services and restrict or disable insecure versions of metadata services that are in use to prevent adversary access.(Citation: Amazon AWS IMDS V2)"}], "gradient": {"colors": ["#ffffff", "#66b1ff"], "minValue": 0, "maxValue": 1}, "legendItems": [{"label": "used by Disable or Remove Feature or Program", "color": "#66b1ff"}]}