{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1685.007","id":"T1685.007","name":"Impair Autonomous Defenses","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1685/007","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"4a7d289920a4dc7115744dc47755008cc357888e118a4d35a954968daa31e818","description":"Adversaries may use methods like [Indirect Prompt Injection](https://attack.mitre.org/techniques/T1698) to disrupt, disable, or otherwise impair autonomous defensive capabilities such as LLM-assisted processing of malware, artifacts, or activity.(Citation: Prompt Injection LLM-Powered SOC Assistants) This behavior may cause a system to ignore data, fail to alert on malicious activity, abort analysis, or to be disabled completely. \n\nAdversaries may include content in malware implants that mimic an LLM prompt scaffold that contains fake system messages in order to convince the LLM that it has encountered an error.(Citation: MacOS.Gaslight Prompt Injection)(Citation: Gaslight AI triage prompt injection) Depending on the type of error, the LLM may abort analysis, truncate, or refuse to continue. Adversaries may also embed prompts in malware intended to stop agents or systems from analyzing the malware.(Citation: Shai-Hulud May 2026) ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1685/007","external_id":"T1685.007"},{"source_name":"Shai-Hulud May 2026","description":"Moshe Siman Tov Bustan. (2026, May 12). Shai-Hulud Goes Open Source: Malware Creators Leak Their Own Code to GitHub. Retrieved September 21, 2026.","url":"https://www.ox.security/blog/shai-hulud-open-source-malware-github/"},{"source_name":"MacOS.Gaslight Prompt Injection","description":"Phil Stokes. (2026, June 23). macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox. Retrieved September 21, 2026.","url":"https://www.sentinelone.com/labs/macos-gaslight-rust-backdoor-turns-prompt-injection-on-the-analyst-not-the-sandbox/"},{"source_name":"Gaslight AI triage prompt injection","description":"Rogue Security Research. (2026, June 29). Gaslight's prompt injection against malware analysis. Retrieved September 21, 2026.","url":"https://www.rogue.security/blog/gaslight-malware-ai-triage-prompt-injection"},{"source_name":"Prompt Injection LLM-Powered SOC Assistants","description":"Tayyeb Nadeem Somro, Bilal Arshad, Dr. Ammara Gul. (2026, June 26). LLM-Powered SOC Assistants: Prompt Injection Risks in Threat Triage. Retrieved September 21, 2026.","url":"https://papers.ssrn.com/sol3/papers.cfm?abstract_id=7179658"}],"platforms":["Windows","SaaS"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"visibility":"source_mapping_gap","visibility_note":null,"parent":{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","domain":"enterprise","level":"technique","parent_id":null,"tactics":["defense-impairment"],"platforms":["Containers","ESXi","IaaS","Linux","macOS","Network Devices","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","network-infrastructure","onprem","virtualization"],"page":"techniques/enterprise/T1685/","constraints":["isolated_authorized_lab","procedure_review_required","telemetry_configuration_required","disposable_tenant_and_cost_controls","some_candidates_require_elevation","potential_disruption_requires_individual_review"],"telemetry_tags":["Cloud Service Modification","Command Execution","Host Status","Process Creation","Process Termination","Service Creation","Service Metadata","Service Modification","Windows Registry Key Modification"],"telemetry_references":[{"id":"DC0069","name":"Cloud Service Modification","tag":"Cloud Service Modification","page":"telemetry/DC0069/","kind":"attack_component"},{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0018","name":"Host Status","tag":"Host Status","page":"telemetry/DC0018/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0033","name":"Process Termination","tag":"Process Termination","page":"telemetry/DC0033/","kind":"attack_component"},{"id":"DC0060","name":"Service Creation","tag":"Service Creation","page":"telemetry/DC0060/","kind":"attack_component"},{"id":"DC0041","name":"Service Metadata","tag":"Service Metadata","page":"telemetry/DC0041/","kind":"attack_component"},{"id":"DC0065","name":"Service Modification","tag":"Service Modification","page":"telemetry/DC0065/","kind":"attack_component"},{"id":"DC0063","name":"Windows Registry Key Modification","tag":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component"}],"detections":{"page":"detections/enterprise/T1685/","status":"rule_source_available","counts":{"sigma":156,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":7,"live_validated":0},"anomaly_types":[]},"detection_status":"rule_source_available","anomaly_tags":[],"tool_tags":["Brute Ratel C4","Cobalt Strike","DCRAT","Donut","Imminent Monitor","SILENTTRINITY"],"tool_references":[{"id":"S1063","name":"Brute Ratel C4","page":"tools/S1063/","kind":"attack_tool","bases":["attack_uses"]},{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"]},{"id":"S9017","name":"DCRAT","page":"tools/S9017/","kind":"attack_tool","bases":["attack_uses"]},{"id":"S0695","name":"Donut","page":"tools/S0695/","kind":"attack_tool","bases":["attack_uses"]},{"id":"S0434","name":"Imminent Monitor","page":"tools/S0434/","kind":"attack_tool","bases":["attack_uses"]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"]}],"visibility":"source_mapped","telemetry_status":"mapped","classification":"can_simulate","candidate_count":77,"implementation":"not_integrated","methods":["automated"]},"children":[],"telemetry":[],"detection":{"key":"enterprise/T1685.007","id":"T1685.007","name":"Impair Autonomous Defenses","domain":"enterprise","platforms":["Windows","SaaS"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"source_url":"https://attack.mitre.org/techniques/T1685/007","technique_page":"techniques/enterprise/T1685.007/","page":"detections/enterprise/T1685.007/","status":"evidence_gap","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":0,"analytics":0,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[],"telemetry_references":[],"visibility":"source_mapping_gap","visibility_note":null,"tool_references":[],"related_parent":{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"detections/enterprise/T1685/","note":"Related parent research only. Not inherited rule or anomaly coverage for this sub-technique."},"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[],"mitigations":[{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Run AI-assisted analysis services using dedicated identities with permissions limited to required analysis functions. Separate analysis authority from broader analyst, administrative, or production access. ","relationship_id":"relationship--f9e2af81-e00e-4a88-965d-482f8105ce88","references":[]},{"id":"M1022","name":"Restrict File and Directory Permissions","url":"https://attack.mitre.org/mitigations/M1022","kind":"course-of-action","description":"Limit AI-assisted analysis systems to the files and directories required for analysis and prevent artifacts under investigation from modifying agent configuration, instruction files, analysis state, or other trusted AI application resources. ","relationship_id":"relationship--2e663f51-b8a5-4578-b824-1277f304e1eb","references":[]},{"id":"M1026","name":"Privileged Account Management","url":"https://attack.mitre.org/mitigations/M1026","kind":"course-of-action","description":"Prevent AI-assisted analysis agents from exercising privileged capabilities solely as a consequence of artifact-derived instructions. Require independent authorization for privileged or consequential operations outside the expected analysis workflow. ","relationship_id":"relationship--df731d6e-b199-468c-b29f-7af3546e6fb4","references":[]},{"id":"M1038","name":"Execution Prevention","url":"https://attack.mitre.org/mitigations/M1038","kind":"course-of-action","description":"Prevent content contained within an artifact under analysis from directly controlling the analysis workflow, terminating analysis, altering required analysis stages, or initiating unrelated tools and actions. Enforce workflow transitions independently of instructions generated from artifact content. ","relationship_id":"relationship--277e7284-90af-45b4-89f7-2eb0a559822b","references":[]},{"id":"M1047","name":"Audit","url":"https://attack.mitre.org/mitigations/M1047","kind":"course-of-action","description":"Require AI-assisted security analysis workflows to preserve analysis status, artifact provenance, tool execution, termination reason, and completion state so that incomplete or unexpectedly redirected analysis can be independently identified and reviewed.","relationship_id":"relationship--a028a375-316c-4a42-ac0f-da77ca5769ef","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1698":"/ttp-simulation/techniques/enterprise/T1698/","T1685.007":"/ttp-simulation/techniques/enterprise/T1685.007/"},"synthetic":null}