Impair an adversary's ability to conduct their operation as intended.
Disruption is used to stop or discourage an adversary from conducting part or all of their mission. This disruption may increase the time, skills, or resources needed for the adversary to accomplish a specific task. For example, a defender may degrade network speeds as the adversary attempts to exfiltrate large blocks of data. As a second example, the defender may manipulate the output of commonly used discovery commands to show targets that do not exist or to hide real targets. In either case, the adversary may waste resources acting on partial or falsified data.
Disruptions may also include planting misinformation designed to influence the adversary's decision-makers to make the wrong decisions or to waste resources.
|Decoy Artifacts and Systems||Introduce impersonations to expand the scope of a deceptive story.||EAC0005|
|Isolation||Configure devices, systems, networks, etc. to contain activity and data, thus preventing the expansion an engagement beyond desired limits.||EAC0020|
|Network Manipulation||Make changes to network properties and functions to achieve a desired effect.||EAC0016|
|Software Manipulation||Make changes to a system's software properties and functions to achieve a desired effect.||EAC0014|