ITM is an open framework - Submit your contributions now.

Insider Threat Matrix™

  • ID: PR018.006
  • Created: 23rd July 2024
  • Updated: 24th July 2024
  • Platforms: Windows, Linux, MacOS
  • Contributor: The ITM Team

Impairing an Anti-Virus Solution

A subject abuses their access or conducts unapproved changes to impair the effectiveness of an anti-virus solution, such as causing it to crash or killing any associated system processes.

Prevention

ID Name Description
PV033Native Anti-Tampering Protections

Commercial security software may include native anti-tampering protections that prevent attempts to interfere with its operations, such as deleting or renaming required files.

Detection

ID Name Description
DT081Security Software Anti-Tampering Alerts

Commercial security software may have the ability to generate alerts when suspected tampering is detected, such as interacting with the process in memory, or attempting to access files related to its operation.