Modify System Image T1601
Tactic: Defense Impairment
Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves. On such devices, the operating systems are typically monolithic and most of the device functionality and capabilities are contained within a single file.
Authoring guide
These 2 rules share fields, values, and exclusions.
Fields filtered most (6 distinct)
These fields appear most often in rule filters.
Top indicator values (20 distinct)
These values appear most often in rule predicates.
Exclusions (5 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Domain: Endpoint