Disable or misconfigure security measures

Cloud Security CI/CD Posture

Attackers disable or misconfigure security controls so that later activity is
not observed or blocked. In software supply chains this is more often a
complete disablement than a subtle misconfiguration: turning off a GitHub
Action required-review check, uninstalling an endpoint agent on a build
runner, skipping a signing gate, or emptying a security-group rule.
Misconfiguration (over-permissive logging, broken audit settings) remains
in scope as the quieter variant of the same Defense Evasion technique.

Where this idea came from

Security article

Cited from a security article or vendor blog in the original YAML; not a first-party incident report.

https://www.upguard.com/blog/cloud-misconfiguration

Sub-techniques

T0144 Misconfigured traffic log settings
T0146 Misconfigured audit logs settings

Mitigations

M1530 Use multi-factor authentication
M1550 Implement strict access control for clouds
M1720 Implement regular patches and updates
M1760 Regularly review and update security configurations
M1761 Implement automated security tools

Detections

D1260 Implement regular security audit and review
D1261 Implement penetration testing
D1262 Implement vulnerability assessment
D1510 Implement Intrusion Detection System and anti-malware
D1520 Implement endpoint detection and response system

Observed in incidents (12)

References

https://www.upguard.com/blog/cloud-misconfiguration