Trusted Design
An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed. This could include maliciously redirecting (Citation: Microsoft Lamin Sept 2017) or even disabling host-based sensors, such as Event Tracing for Windows (ETW),(Citation: Microsoft About Event Tracing 2018) by tampering settings that control the collection and flow of event telemetry. (Citation: Medium Event Tracing Tampering 2018) These settings may be stored on the system in configuration files and/or in the Registry as well as being accessible via administrative utilities such as PowerShell or Windows Management Instrumentation.
ETW interruption can be achieved multiple ways, however most directly by defining conditions using the PowerShell Set-EtwTraceProvider cmdlet or by interfacing directly with the registry to make alterations.
In the case of network-based reporting of indicators, an adversary may block traffic associated with reporting to prevent central analysis. This may be accomplished by many means, such as stopping a local process responsible for forwarding telemetry and/or creating a host-based firewall rule to block traffic to specific hosts responsible for aggregating events, such as security information and event management (SIEM) products.
T1054（Indicator Blocking：インジケーター・ブロッキング）は、攻撃者が自身の活動を隠し、被害者に気づかれないようにするために、セキュリティ製品の検知機能や通知機能を直接妨害する技術です。
Indicator Blockingとは、セキュリティソフト（AV, EDR, IDSなど）やログ収集機能が、「異常」を検知してアラートを出すプロセスを物理的・論理的に遮断する行為です。
攻撃者は権限を取得した後、以下のような方法でシステムの「目」を塞ぎます。
net stop コマンドや TerminateProcess を使い、エンドポイント保護製品のサービスやエージェントを強制終了させます。T1054は「設定変更」や「コマンド操作」で行われることが多いため、特定の脆弱性（CVE）を介さない場合も多いですが、以下の事例が有名です。
この攻撃手法を利用する脅威アクターは登録されていません。